MALICIOUS — Aurora.exe
MALICIOUS — Aurora.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the STRATO family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
3a54eee619f4f4b3ffb476b5e77a06ee7c32ef9c0ccc7406dcac5e724b34c8af - SHA-1:
53860dde1ac70df87457981964360d5255fc901f - MD5:
e0689b7c6ad5f546e21230b1bf31a113 - imphash:
c2cb926c3c9350199591b4b0491028d2 - ssdeep:
3072:s8KZQHjWatUHkh5i7/zOE714qebJ2J1nn/uy:JKQDWSh55e1/ - TLSH:
T1863F5C96826732A2E2B6DA84AC948DDDCC73F0AE2471E54C5A03CC9D70C5237E8F156D - Submitted as: Aurora.exe
- File type: pe · Size: 159232 bytes
- Verdict: malicious (92/100) · Family: STRATO
Detections (4 of 56 engines)
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
- Microsoft Defender: Trojan:Win32/Malgent
- Emsisoft (Emergency Kit): Trojan.GenericKD.81400020
- Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 5 weighted signals:
- Microsoft Defender flagged Trojan:Win32/Malgent (rule
Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.81400020 (rule
Trojan.GenericKD.81400020) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule
UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85 - YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded domains
- aurora15.onlyonemzy.com
More STRATO samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report