Aurora Stealer is a Go-based Windows info-stealer operated as
Malware-as-a-Service by a Russian-speaking actor calling
themselves 'Cheshire' (forum handle cheshire666 on WWH
Club). Public writeups document the family as active since at
least mid-2022. Aurora started as a multi-purpose botnet and
evolved to focus on credential and cryptocurrency theft.
The operator-side UserInformation.txt panel opens with two
self-declaration header lines pointing at the
t.me/cheshire_aurora channel and
t.me/aurora_botnet_support support handle, followed by four
<================ SECTION ================> section headers
(BUILD INFORMATION, GEO INFORMATION, USER INFORMATION, PC
INFORMATION) with tilde-equals padding around the label.
Fields include HWID, Log date, FileLocation, IP, Country,
Region, City, ScreenSize, and dash-prefixed hardware inventory
(- CPU / - RAM / - Display Devices).
The FileLocation value carries a WinRAR temp-extraction
path (Rar$EX...) with a U+3164 Hangul Filler disguise: the
observed sample pads Script inside.txt with many invisible
filler characters so the actual .exe extension gets pushed
off-screen in most file explorers. Victims see the file as
Script inside.txt and double-click it, executing the malware
directly from inside the RAR archive listing without
extracting first.
The C2 wire format is documented as JSON, GZIP-compressed, and
Base64-encoded. The observed plain-text panel render is the
operator-facing dashboard shape, not the wire format.
Multiple Telegram resellers repackage Aurora logs; the
observed sample ships through @UP_DAISYCLOUD with the Daisy
Cloud pipe-bordered banner and per-line watermark overlay.
