MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AuroraStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73
SHA3-384 hash: b91a295e8c68d6151f34c752c6f27a01408d7838ab6112145fe418cccd1596a3d115b4d85955b30c21e213ed0fa54b1c
SHA1 hash: 53d51d7c43f6af46f720025eafbf346586bfae09
MD5 hash: 4a39e396ddbd9c7116858b6f96a06eb2
humanhash: alanine-north-eleven-yankee
File name:4a39e396ddbd9c7116858b6f96a06eb2.exe
Download: download sample
Signature AuroraStealer
Create hunting rule
File size:1'487'606 bytes
First seen:2023-03-08 20:20:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5a95fc1207ce8743cd9161ce41436aa4 (1 x RedLineStealer, 1 x Smoke Loader, 1 x AuroraStealer)
ssdeep 24576:mFsLW3eGfYYrd+z9tEdnJkQ8D9rgf2UhxVgnj20E+3b+sC5E2B7K1X42tdYyTr6i:BLWuMrpP8D98XYqY36sCFK1I2tqu2T47
Threatray 9 similar samples on MalwareBazaar
TLSH T11365231076B5D333C40FE53E5AA4DBD21A777520BBFC9E63326A20672A206D2C17A35D
TrID 39.5% (.EXE) InstallShield setup (43053/19/16)
28.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.6% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 411adeca868c9e84 (1 x AuroraStealer)
Reporter abuse_ch
Tags:AuroraStealer exe


Avatar
abuse_ch
AuroraStealer C2:
94.142.138.34:8081

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4a39e396ddbd9c7116858b6f96a06eb2.exe
Verdict:
Malicious activity
Analysis date:
2023-03-08 20:21:49 UTC
Tags:
installer stealer aurorastealer
Link:
https://app.any.run/tasks/1c2fe869-92e8-4813-96bc-93a1263b814d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/372688/
Detection(s):
Sanesecurity.Malware.28937.BadIN.UNOFFICIAL
Create hunting rule

Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Running batch commands
Creating a file in the %temp% directory
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult buzus greyware lockbit overlay packed zusy
Link:
https://www.filescan.io/uploads/6408ee2e8b48bcea611f452b/reports/666e2016-198a-401b-a80e-f93b24937271/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Aurora Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/44d5c97f-a909-48c2-a752-bf08f401149a
Result
Threat name:
Aurora
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1189766
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara Aurora Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 822647 Sample: gb4H5YPAd7.exe Startdate: 08/03/2023 Architecture: WINDOWS Score: 100 29 Snort IDS alert for network traffic 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Antivirus / Scanner detection for submitted sample 2->33 35 5 other signatures 2->35 7 gb4H5YPAd7.exe 11 2->7         started        process3 dnsIp4 27 94.142.138.34, 49698, 8081 IHOR-ASRU Russian Federation 7->27 37 Detected unpacking (changes PE section rights) 7->37 39 Detected unpacking (overwrites its own PE header) 7->39 41 Tries to harvest and steal browser information (history, passwords, etc) 7->41 11 cmd.exe 1 7->11         started        13 cmd.exe 1 7->13         started        15 WMIC.exe 1 7->15         started        signatures5 process6 process7 17 WMIC.exe 1 11->17         started        19 conhost.exe 11->19         started        21 WMIC.exe 1 13->21         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73/
Threat name:
Win32.Spyware.Aurorastealer
Create hunting rule
Status:
Malicious
First seen:
2023-03-08 20:29:20 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
22 of 25 (88.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w4yyuoafka2fphh3m6m72lfsmsto6gu7lvuvffyeotsbhe3u55zq._file
Verdict:
malicious
Similar samples:
07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
AuroraStealer
3d10b461229396493d0c7e2877360f66e41e11dbc201a11e382ac3f19c10d4fc
AuroraStealer
48392e0c0969580a9eaa9fa882b543b319ea08e6492d3a6819bc0c5b64d78396
AuroraStealer
51b8e08571ddd7d98f4da91561999fce1b454ea42b3b83655f207df77f02ae1d
AuroraStealer
5fd08734c0379fc5b78aa4e80fb12080735e86404d279fd43903d1d54c278989
AuroraStealer
84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
AuroraStealer
e9c03d5984c7b81473046754979db24bb5c8b45e31603bc48b89a40aa7ce4431
AuroraStealer
Result
Malware family:
aurora
Create hunting rule
Score:
  10/10
Tags:
family:aurora spyware stealer
Link:
https://tria.ge/reports/230308-y4y3hagh22/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Aurora
Malware Config
C2 Extraction:
94.142.138.34:8081
Unpacked files
SH256 hash:
0ea585b0febda76824c3cf9ec917b00ff4fb04ef668d76cea0d5e2818e7064fd
MD5 hash:
6eb86eedceab42a3c2e5a4eb4320ee03
SHA1 hash:
032743596b8a65ea7f3eb5899fe74dac06b72b52
Link:
https://www.unpac.me/results/c105e28c-e1ae-47b9-a24d-c985b1f1086d/
SH256 hash:
b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73
MD5 hash:
4a39e396ddbd9c7116858b6f96a06eb2
SHA1 hash:
53d51d7c43f6af46f720025eafbf346586bfae09
Link:
https://www.unpac.me/results/c105e28c-e1ae-47b9-a24d-c985b1f1086d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b7318a380550/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_aurora_stealer_a_706a
Create hunting rule
Author:Johannes Bader
Description:detects Aurora Stealer samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AuroraStealer

Executable exe b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2563354/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/372688/

Comments