Loading malware…
AuraStealer is a Windows malware-as-a-service infostealer that emerged in mid-2025 and has been marketed on cybercrime forums under a subscription model. It is assessed to be operated or developed by Russian-speaking actors and is actively distributed through social-engineering campaigns, notably TikTok-based ClickFix or “Scam-Yourself” lures that persuade victims to execute malicious PowerShell commands. It has also been distributed through cracked software, self-extracting archives, malicious scripts, loaders, DLL sideloading, and process-injection chains.
AuraStealer targets Windows 7 through Windows 11 and collects browser credentials, cookies and session tokens, cryptocurrency-wallet data and recovery phrases, password-manager data, two-factor-authentication data, VPN configurations, API keys, clipboard contents, screenshots, system information, process information, and selected files. It targets data in browsers, browser extensions, cryptocurrency wallets, messaging applications, and gaming-related services. It can bypass Chromium Application-Bound Encryption by executing code in a browser security context to recover browser encryption material, enabling theft of protected browser data. It can also execute additional payloads.
The malware uses encrypted embedded configuration and encrypted command-and-control traffic. Its anti-analysis and defense-evasion features include anti-debugging, anti-VM and anti-sandbox checks, geofencing that avoids systems in former Soviet Union regions, anti-tampering checks, string and constant obfuscation, indirect control-flow obfuscation, runtime API resolution, exception-driven API dispatch, and use of low-level system-call techniques. AuraStealer operations use a web management panel for build generation and handling stolen data.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
42 distinct techniques documented for this family, organized by ATT&CK tactic.
Victims manually execute attacker-supplied PowerShell commands (from video or clipboard) in elevated PowerShell / Run dialog to fetch & run the payload.
Heavy direct and obfuscated use of WinAPI/NTDLL (e.g., VirtualAlloc, NtCreateSection, NtMapViewOfSection, NtCreateThreadEx, COM IElevator::Decrypt).
Execution always requires user action (copying & pasting commands, running an installer, enabling a VS Code extension).
Indirect control flow obfuscation; XOR-encrypted constants and strings; AES-encrypted embedded configuration; API hashing; exception-driven control flow.
Custom exception-driven API hashing (MurmurHash3 + FNV-1a + XOR) with lookup tables and deliberate exceptions to resolve and call WinAPI.
Injection into browser processes using NtCreateSection + NtMapViewOfSection + NtCreateThreadEx to run shellcode for ABE bypass.
Configuration option to self-delete on completion of data theft, removing forensic artifacts of the stealer binary.
Runtime decryption of strings and AES-CBC decryption of embedded configuration data.
"injected into legitimate Windows processes like regasm.exe and SndVol.exe"
Refuses to run in certain locales (CIS, Baltic states) via LCID and country code checks; additional anti-VM, anti-sandbox, and human-presence checks restrict execution to “real” user systems.
Combined VM/sandbox detection: hypervisor bit, screen size, RAM, CPU count, process count, blacklisted DLLs; ensures execution only on suitable targets.
Uses cpuid hypervisor bit, screen resolution (GetWindowRect > 1024), non-zero physical memory, CPU-count + process-count heuristic for VM vs real host, and blacklist of sandbox-related DLLs.
Sleep-hook detection via GetSystemTimePreciseAsFileTime before/after Sleep(1000); <900 ms indicates hooked/accelerated sleep.
Position-independent shellcode mapped into remote process memory via sections and executed without conventional module loading.
Reads PEB (BeingDebugged, NtGlobalFlag), checks KUSER_SHARED_DATA; uses NtCreateDebugObject + NtQueryObject to detect extra handles; scans running processes against debugger/monitor blacklist; inspects return addresses for INT3/UD2 and introduces delayed stack corruption.
Steals browser cookies and active session data (discord/telegram/steam session tokens) from browser profiles.
Reads credentials/API keys from local config files (e.g., RDP/AnyDesk configs, FileZilla credentials, VPN configuration files, wallet data files).
Steals credentials and secrets from password managers (KeePass, Bitwarden, 1Password, LastPass) and other local stores.
Enumerates running processes to perform anti-VM (process count) and anti-debug (blacklisted analysis tools) checks; also exfiltrates process list.
Collects general system fingerprinting data; uses system metrics extensively in anti-VM/anti-sandbox logic.
Combined VM/sandbox detection: hypervisor bit, screen size, RAM, CPU count, process count, blacklisted DLLs; ensures execution only on suitable targets.
Uses cpuid hypervisor bit, screen resolution (GetWindowRect > 1024), non-zero physical memory, CPU-count + process-count heuristic for VM vs real host, and blacklist of sandbox-related DLLs.
Sleep-hook detection via GetSystemTimePreciseAsFileTime before/after Sleep(1000); <900 ms indicates hooked/accelerated sleep.
Module and process enumeration to detect security tools, emulators, debuggers, and sandbox indicators (DLLs and process names).
Compares GetUserNameW/GetComputerNameW against known Microsoft Defender emulator values (JohnDoe, HAL9TH) and checks loaded modules against blacklist of analysis/sandbox DLLs.
Reads PEB (BeingDebugged, NtGlobalFlag), checks KUSER_SHARED_DATA; uses NtCreateDebugObject + NtQueryObject to detect extra handles; scans running processes against debugger/monitor blacklist; inspects return addresses for INT3/UD2 and introduces delayed stack corruption.
Steals files from local disk, including via wildcard-based search (configurable masks, paths, recursion) for arbitrary files of interest.
Aggregates collected data into local archives, then splits them into chunks prior to exfiltration.
...routing all traffic through Cloudflare as a reverse proxy to conceal the real server.
"To hide the real server, the actor routes all traffic through Cloudflare as a reverse proxy."
359 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a comparison for REVSTEALER's payload-watermarking mechanism.
Infostealer mentioned only as a comparison for a verification-code-based anti-analysis mechanism.
Mentioned only as a comparison for a payload-watermark verification technique.
Referenced only as a comparison family that did not technically match the observed sample.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.