en
Aura StealerAuraStealerAuraStealer (also known as Aura Stealer and AuraStealer) is an information-stealing malware family. AuraStealer targets browser credentials, cryptocurrency wallets, 2FA codes and System hardware and installed-software inventory. As of 11/10/2026, CyStack's research records 1 variant, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Aura Stealer (a.k.a. AuraStealer) is a C++ infostealer-as-a-service advertised on underground forums from July 2025 by the
threat actor AuraCorp. Subscription tiers ship a builder plus
a web panel that aggregates harvested logs. Antivirus
signatures catalogue it under the detection name
Trojan:MSIL/AuraStealer.AUKB!MTB; Public malware trackers
list it as win.aurastealer.
The on-wire exfil is JSON, GZIP-compressed and Base64-encoded
to the C2. The artifact documented here is the operator-facing panel render written as System.txt inside each per-victim folder. The render opens with an AURA v<x.y.z> build
banner, then a top block of identity fields (HWID:, the
Launched at: local/UTC pair, Location:, the elevation
flags), then four square-bracket sections in order: [System Info], [Hardware], [Processes List], [Installed Software]. The Location: field carries the
process-hollowing target, usually
C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe
per the publicly documented injection chain.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
97204ed... | 3,537 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
HWID: <value>Launched at: Local time: <value> UTC time: <value>Location: <value>Run as Admin: <value>User in Admins group: <value>Running on: <value> OS Name: <value> Edition: <value> Version: <value> Build Number: <value> Build Lab: <value> Install Date: <value> Product Id: <value> Architecture: <value> Language: <value> Keyboard Layouts: <value> Time Zone: <value> Computer Name: <value> User Name: <value> Screen resolution: <value> CPU: <value> RAM: <value> GPUs: <value>
