# List of Aurora / Hydraq / Roarur files

**[contagiodump.blogspot.com/2010/02/list-of-aurora-hydraq-roarur-files.html](http://contagiodump.blogspot.com/2010/02/list-of-aurora-hydraq-roarur-files.html)**

I see multiple searches for Hydraq MD5 information leading to this post -Trojan.Hydraq
detection and naming so I am adding a few things now.
McAfee issued a guide outlining all the symptoms of Aurora infection "How Can I Tell if I Was
Infected By Aurora?"

Links to Virustotal
**The list of files** **[provided by](http://www.blogger.com/goog_1265645069627)** **[McAfee is the following](http://www.mcafee.com/us/local_content/reports/how_can_u_tell.pdf)**
securmon.dll       E3798C71D25816611A4CAB031AE3C27A   (Wed Dec 16 13:20:28
2009)
Rasmon.dll        0F9C5408335833E72FE73E6166B5A01B     (Tue Jul 21 01:38:07
2009)
[a.exe            CD36A3071A315C3BE6AC3366D80BB59C](http://www.virustotal.com/analisis/97a5f25be001667958fee414b2801be9749751697b35c528983fd047305a37ea-1264632117)
b.exe            9F880AC607CBD7CDFFFA609C5883C708   (Tue Jul 21 01:38:27
2009)
AppMgmt.dll      6A89FBE7B0D526E3D97B0DA8418BF851    (Sat Sep 19 02:36:44
2009)
A0029670.dll     3A33013A47C5DD8D1B92A4CFDCDA3765  (Wed Dec 16 05:55:31
2009)
[msconfig32.sys    7A62295F70642FEDF0D5A5637FEB7986](http://www.virustotal.com/analisis/3ecf09aaf0a455aa9d7d375c8eb2efb41a9202420b83bf6bbda017aca3e3412b-1263711847)

You also may have the following files or same name files but different MD5 hash

[Additional - list from ANTY Security](http://www.antiy.com/cn/security/2010/s100128_002.htm)
30755.malware*(?) 1B59487D4DC029D92B61ABD4F69C9923    (Tue Jul 21 01:38:27
2009)

1.bin*           BCBEF5AB2C75C171FEDCCA0A33BCF7F7  (Tue Jul 21 01:38:27
2009)
Rasmon.dll        32CC9F9DA93DD4E9FD3D203881197CBF   (Tue Jul 21 01:38:07
2009)

Rasmon.dll        2CFCD8C34F22FFB772C99C9293C21BDA   (Tue Jul 21 01:38:07
2009)
Rasmon.dll        3A33013A47C5DD8D1B92A4CFDCDA3765   (Wed Dec 16 05:55:31
2009)


-----

Rasmon.dll        4A069A20B8262B20E7440C8AB9C54E11    (Tue Jul 21 01:38:07
2009)
Rasmon.dll        80FC413CF908CD4506C3F790E484822E     (Tue Jul 21 01:38:07
2009)
**[Additional - list from Security.nl](http://www.security.nl/files/aurorafiles.txt)**
jucheck.exe      79ABBA920201031147566F5418E45F34       (Sun Nov 22 18:25:44
2009)
AdobeUpdateManager.exe 9A7FCEE7FF6035B141390204613209DA(Sun Nov 22 18:10:09
2009)
zf32.dll EB4ECA9943DA94E09D22134EA20DC602    (Fri Mar 5 18:29:00
2004)

- Password protected archive, please contact me for the password if you need it.


-----