Overview

overview

10

Static

static

1

cd4b68e09b...07.exe

windows7-x64

10

cd4b68e09b...07.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

  • Size

    7.5MB

  • Sample

    240524-ljsnrscf3z

  • MD5

    b2c713fe8dbaea840c00afd0f67f1d9d

  • SHA1

    036dab17619a4ca6e1036d99b68b10aea5872968

  • SHA256

    cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707

  • SHA512

    03276046a65a6fda948f63d3e5bb7d4466ff2933677c0f847f927d50b04f3d1600d3c7e5fc905f6a54f2de9fdedc46326d39c160ff37d3a4cd874d20f01cef18

  • SSDEEP

    24576:24wquL3a5sUcuADwRSP5C5AG1yO80IpNKF7r1IlP6jBktGr4ICqJIJFTWjiQWdtC:CquL38soADw45Ccgk+lKCtoPEz1b

Score
10/10
aurorastealer

Malware Config

Extracted

Family

aurora

C2

94.142.138.29:8081

Targets

    • Target

      cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

    • Size

      7.5MB

    • MD5

      b2c713fe8dbaea840c00afd0f67f1d9d

    • SHA1

      036dab17619a4ca6e1036d99b68b10aea5872968

    • SHA256

      cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707

    • SHA512

      03276046a65a6fda948f63d3e5bb7d4466ff2933677c0f847f927d50b04f3d1600d3c7e5fc905f6a54f2de9fdedc46326d39c160ff37d3a4cd874d20f01cef18

    • SSDEEP

      24576:24wquL3a5sUcuADwRSP5C5AG1yO80IpNKF7r1IlP6jBktGr4ICqJIJFTWjiQWdtC:CquL38soADw45Ccgk+lKCtoPEz1b

    Score
    10/10
    aurorastealer

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks