Auraboros C2

MITRE ATT&CK Mapping ... Persistence Software Update T1195 OTA agent self-update

It supports... arbitrary shell command execution...

MITRE ATT&CK Mapping ... Defense Evasion Masquerading T1036.005 DiskIntegrityScanner.exe

It supports... Wi-Fi password extraction...

MITRE ATT&CK Mapping ... Collection Input Capture: Keylogging T1056.001 Live keylogger with 3s polling

Six unauthenticated API endpoints expose... stolen browser credentials... The cookie impersonation engine then takes the stolen cookies, generates a session cloning script...

The credential theft mechanism targets Brave and Chrome browsers using Windows DPAPI... decrypts it using the Windows CryptUnprotectData function, and then copies the Login Data SQLite database to query for stored passwords and session cookies.

MITRE ATT&CK Mapping ... Credential Access Credentials from Password Stores: Web Browsers T1555.003 Chrome/Brave extraction

MITRE ATT&CK Mapping ... Discovery Network Service Discovery T1046 ARP scan + port scan

MITRE ATT&CK Mapping ... Discovery Process Discovery T1057 get_processes

MITRE ATT&CK Mapping ... Discovery System Information Discovery T1082 CPU, RAM, disk, motherboard fingerprint

It supports... file browsing...

When this file runs, it loads a malicious DLL that immediately executes a “CollectData” routine, harvesting the machine’s hostname, username, and privilege level before registering with the C2 server.

MITRE ATT&CK Mapping ... Collection Input Capture: Keylogging T1056.001 Live keylogger with 3s polling

It supports screenshot capture, webcam snapshots, clipboard theft, live keylogging with three-second polling intervals...

It supports screenshot capture, webcam snapshots, clipboard theft, live keylogging with three-second polling intervals...

MITRE ATT&CK Mapping ... Collection Audio Capture T1123 audio_start live streaming

It supports screenshot capture, webcam snapshots, clipboard theft, live keylogging with three-second polling intervals...

The entire command-and-control (C2) dashboard operates over plain HTTP with no login, no token, and no authentication of any kind... The malware’s C2 panel... runs on port 5000 using an Express.js and Socket.io backend.

MITRE ATT&CK Mapping Tactic Technique ID Implementation Command and Control Application Layer Protocol: Web T1071.001 Express.js + Socket.io C2

MITRE ATT&CK Mapping ... Command and Control Proxy: SOCKS T1090.001 Reverse SOCKS5 on port 1080

It supports... reverse SOCKS5 proxying on port 1080... The cookie impersonation engine then takes the stolen cookies, generates a session cloning script, and routes traffic through the victim’s SOCKS5 proxy tunnel...

MITRE ATT&CK Mapping ... Exfiltration Exfiltration Over C2 Channel T1041 All data via HTTP API