MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AuroraStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA3-384 hash: f3964a43f41e41356341a67db32cb8486de1a25e05f56a68d6cb54f9f6136705fb7bc3a4afca739a0b01f1cf417968d5
SHA1 hash: 3f949a4b96bac4f7e1cec881edb5b65295410a1c
MD5 hash: 50d48404f9b93a16c69aed2e6c585192
humanhash: mango-florida-bluebird-alpha
File name:50d48404f9b93a16c69aed2e6c585192.exe
Download: download sample
Signature AuroraStealer
Create hunting rule
File size:3'114'234 bytes
First seen:2023-02-12 21:05:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9cbefe68f395e67356e2a5d8d1b285c0 (58 x LummaStealer, 49 x AuroraStealer, 35 x Vidar)
ssdeep 49152:Eer33gFd4ujF1gD2hJAUIaEsLFA8uJp5vk1b:d04yhDTLO8uE
Threatray 56 similar samples on MalwareBazaar
TLSH T107E5084BB89481F4C0AEE230C9659253BA713C855F3163E73B10B3B92B77BD85A7A354
gimphash d166167c5dab7e8a92f3c96f917d72b9f192036eff3f76a59003ce3894996f55
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:AuroraStealer exe


Avatar
abuse_ch
AuroraStealer C2:
107.182.129.73:8081

Intelligence

File Origin
# of uploads :
1
# of downloads :
243
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
50d48404f9b93a16c69aed2e6c585192.exe
Verdict:
Malicious activity
Analysis date:
2023-02-12 21:08:00 UTC
Tags:
stealer aurorastealer
Link:
https://app.any.run/tasks/3e1e8040-87ef-4931-ac6f-b9a13e30ca14

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/364622/
Detection(s):
Win.Infostealer.Aurora-9980073-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a process with a hidden window
Running batch commands
Sending a custom TCP request
Creating a file in the %temp% directory
Reading critical registry keys
Stealing user critical data
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/68704/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm aurora golang greyware meterpreter overlay
Link:
https://www.filescan.io/uploads/63e954bc2a0480293f8cb3f7/reports/ea8d1242-d031-4a43-b04c-c19d72fafadc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Kraken
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b7bcdae4-5828-4f78-a37d-9501366b8a79
Result
Threat name:
Aurora
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1172801
Signature
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara Aurora Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 805591 Sample: comGhpTVqq.exe Startdate: 12/02/2023 Architecture: WINDOWS Score: 80 29 Snort IDS alert for network traffic 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara Aurora Stealer 2->33 35 2 other signatures 2->35 7 comGhpTVqq.exe 11 2->7         started        process3 dnsIp4 27 107.182.129.73, 49701, 8081 META-ASUS Reserved 7->27 37 Tries to harvest and steal browser information (history, passwords, etc) 7->37 39 Potentially malicious time measurement code found 7->39 11 cmd.exe 1 7->11         started        13 cmd.exe 1 7->13         started        15 WMIC.exe 1 7->15         started        signatures5 process6 process7 17 WMIC.exe 1 11->17         started        19 conhost.exe 11->19         started        21 WMIC.exe 1 13->21         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-02-12 21:07:06 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 39 (43.59%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjxnjgqbu7cmvvxksfcjlvlytol2tgjvbd7if7zsgjqtv6zka6eq._file
Verdict:
malicious
Similar samples:
07df13bc321083e74a3512b9861332e566c8d2ff201a3a5c8fcd2fd9fc8bfef6
AuroraStealer
34b0b1afe764347cb079e85f1b43c2eeec8db766a7a23bf7d9e8741036b2a1e0
AuroraStealer
47a40add511868171afab04d336c6120be951799b6230fdbd581e6469e1a088e
AuroraStealer
4ee57fb21fecb95c59ed64430a0aea7ce91035702fdc626851e8d9e866d0a542
AuroraStealer
58e19ae5b80eaf4e0d071146b05c118143b432c2e4d117141dd71bc82cbf34c3
AuroraStealer
af1f5335d497726e81237f3049d3918c32f8ac999b9ca21cf3535a57162f0fc9
AuroraStealer
c81897d050c7ba737b4e0a1e48a4c2513557521720a55d2be0d63ed3df0b22ea
AuroraStealer
ca3f06b6dde9cc4efbde24b59b3eb434a9e62b8e2ec38675be62254a065d95a1
AuroraStealer
+ 46 additional samples on MalwareBazaar
Result
Malware family:
aurora
Create hunting rule
Score:
  10/10
Tags:
family:aurora spyware stealer
Link:
https://tria.ge/reports/230212-zxq9raga2s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Malware Config
C2 Extraction:
107.182.129.73:8081
Unpacked files
SH256 hash:
0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
MD5 hash:
50d48404f9b93a16c69aed2e6c585192
SHA1 hash:
3f949a4b96bac4f7e1cec881edb5b65295410a1c
Link:
https://www.unpac.me/results/309a5eaf-5651-4a78-a02a-d7214fa051a7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0a6ed49a01a7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Aurora
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:win_aurora_stealer_a_706a
Create hunting rule
Author:Johannes Bader
Description:detects Aurora Stealer samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AuroraStealer

Executable exe 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2393359/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/364622/

Comments