13 minhigh
Infostealers highlight malware-as-a-service trend
ReversingLabs identified three active infostealer malware-as-a-service families: AuraStealer, ACRStealer/Amatera, and RemusStealer, with 1,110 unique samples observed between June and August 2026. RemusStealer distinguishes itself through Etherhiding, using Ethereum smart contracts for C2 domain resolution. AuraStealer adopted virtualization-based obfuscation, increasing its file size from 500-700KB to 10MB. All three families target browser credentials and crypto wallets, distributed via ClickFix, ClearFake, SEO poisoning, and malvertising.
Sens:▲ 24hConf:high
Showing defanged values
- domainaewaterdelivery[.]comAuraStealer C2 domain
- domainaimemtools[.]cfdAuraStealer C2 domain used for data exfiltration
- domainauth[.]automationportal[.]ccACRStealer/Amatera C2 domain
- domainazurhay[.]shopRemusStealer C2 domain resolving to non-standard port 8539
- domaincarogra[.]bizRemusStealer C2 domain on port 4219
- domaindata[.]nomadhive[.]ccACRStealer/Amatera C2 domain
- domaindev-tools[.]cfdAuraStealer C2 domain
- domainedge[.]kernelmonitor[.]ccACRStealer/Amatera C2 domain
- domainfimmora[.]surfRemusStealer C2 domain on port 6504
- domainfreshis[.]bizRemusStealer C2 domain on port 7752
- domaingw[.]portallbridge[.]ccACRStealer/Amatera C2 domain used for data exfiltration
- domainhooiuse[.]clickRemusStealer C2 domain on port 4938
- domainlogin[.]metricsdashboard[.]ccACRStealer/Amatera C2 domain
- domainmemaiagent[.]cfdAuraStealer C2 domain
- domainmyrtler[.]bizRemusStealer C2 domain on port 9549
- domainonesdto[.]shopRemusStealer C2 domain on port 2535
- domainres[.]explicittweak[.]ccACRStealer/Amatera C2 domain
- domainsecupd[.]cfdAuraStealer C2 domain
- domainslyfogx[.]shopRemusStealer C2 domain on port 5776
- domainsoftwareguard[.]cfdAuraStealer C2 domain used for data exfiltration
- domainstatic[.]quorashift[.]ccACRStealer/Amatera C2 domain
- domainstream[.]pawpalace[.]ccACRStealer/Amatera C2 domain
- domainsys-tools[.]cfdAuraStealer C2 domain
- domaintopxgax[.]clickRemusStealer C2 domain on port 4930
- domaintzpx[.]coursesRemusStealer C2 domain on port 4437
- domainuiccvbk[.]clickRemusStealer C2 domain on port 8839
- domainwss[.]vectorplatform[.]ccACRStealer/Amatera C2 domain
- domainyoungel[.]bizRemusStealer C2 domain on port 8768
- domainzelpx[.]gardenRemusStealer C2 domain on port 9895
- domainzkevopenanu[.]cfdAuraStealer C2 domain
- ip158[.]94[.]208[.]7AuraStealer payload download server
- ip158[.]94[.]211[.]222AuraStealer payload download server hosting multiple malicious executables
- ip85[.]239[.]147[.]6AuraStealer payload download server hosting multiple malicious executables
- ip91[.]92[.]241[.]243AuraStealer payload download server
- ip91[.]92[.]242[.]236AuraStealer payload download server hosting malicious executables
- sha11c24da264bce471366156b4721bacb83201ba759AuraStealer dropped/downloaded file
- sha17c0f669cd06e5ba8fdcdba107b9519fe73519368AuraStealer dropped/downloaded file
- sha1c4831ec2b68c576199245eb877e83f9b5e83dd3fAuraStealer dropped/downloaded file
- sha256000b7533d53d0feed7cd995043a4298fe2b8c5767c1ffff7710f446c682928cbRemusStealer sample
- sha25601718933eb502e4ec9d4b1210a88cb026882d615605dd8d7fbf1c4057b7c0867AuraStealer sample
- sha25606f6a0dc417bf0c8d1fa54754f53d37d190a3b9bf66658e00a630ae0bb56dfabACRStealer/Amatera packed sample
- sha2560843ddfbe1908c5151495295ff7d1007b3c8bca287a766c437cea6b0e3f72f4dACRStealer/Amatera packed sample observed July 2026
- sha2560fac8922b1afc82d02b7a2d059ec6964a0b29196166b1377d165c08e134400dbACRStealer/Amatera unpacked sample
- sha2561019d8a20bd7732b2c2747b30646a5d10725fd5ee532b5e858dab27ba150db1eACRStealer/Amatera packed sample
- sha256127bfec23f77b6c9f2addd7f1fe8016b41078c8dbdda34737f7cb6b5563ec22bACRStealer/Amatera unpacked sample
- sha256134ab4b33ab555f3a77d43e94891698834a9b739b065764a702c7c52e3f4c15bAuraStealer sample
- sha256167873a847a2b996bd3b44b38c819768274efda6daf2978532c7b6b4f1a0acb1ACRStealer/Amatera unpacked sample
- sha25621c11f37cbf8365d26d243515cd23e822ecfa1d25f3262b62ffb1085efd09d9cACRStealer/Amatera unpacked sample
- sha256242871749873401e97d2651c5bc1c874ae9a3832a1c14b48630390dff0acafc0ACRStealer/Amatera unpacked sample
- sha256252ad5844e88d5e3da533f8d913442cdc72d018ed29594a994e19a403026aa0dACRStealer/Amatera unpacked sample
- sha25628d1f5d695ed65461b36f032f057a2d48b97ea68f149c73ea3401bf9ec0576cbRemusStealer infostealer sample observed August 2026
- sha2562ab248b392653566fe4fb34e2ced50acd8e91941010f38e2a85c792968261f20ACRStealer/Amatera packed sample
- sha2562abb2d9250e78af3b0636a83f6031a14512d7d891e34a043cafc771f2ac3ea12ACRStealer/Amatera unpacked sample
- sha2562f029858b8ecca8fb6c156eb2d046a2463e8b67d356c1003e5567339681a71beRemusStealer sample
- sha2563575caf8bd87912689ebb1d13770990248f93c5d882db8c849bee02cb7c0abadAuraStealer sample
- sha25636cfccc84b21d9bb8b3eb93589870aea0b146fd9ba649b785d44bb8dafd82656AuraStealer sample
- sha256377e1b540fd76b28638231ca69f955130768ea9de045e6af18b6e5b88e59211dACRStealer/Amatera unpacked sample
- sha256397566a51d405c351e5134650463d5872e218682f7f34a5f314539d087837ea4AuraStealer sample
- sha2563efc1f87e3f0566daef895ddccf21dff9eb70fbea17ec7d60ba7fdceb35c1b5cAuraStealer sample
- sha2563fa65bbadec7e0d448b4d167ac48399f1f9a0966d5574b25876169171a204abaACRStealer/Amatera unpacked sample
- sha25641b3e4f80aa2deeaf56c5181cd3fc1b2ee545d053d29934408bb17ddd7ea2096ACRStealer/Amatera packed sample
- sha2564332227474b0d7db91a1e156ac3afa58ea4973ff00cb455dfd073fa1ec6dabcdACRStealer/Amatera unpacked sample
- sha256450216a711f8b3371a2936923201f204fa1c686a2b831dac4a1c0094c105a5fdRemusStealer sample
- sha25647a7a38d8e7d729aa0d9312fae2ebd13b7c11a5ae91474a883b7ceb56298f395ACRStealer/Amatera unpacked sample
- sha25647d5a5ef1afe3d1b8dbfde026a80d97ed0e012c144fa3940bb39758de75ca842RemusStealer sample
- sha25648b82c79a90ed401449260948b269d0909bbdb53847678dfbba09c368016bd7eRemusStealer sample
- sha2564a3cf2cd75d78359f4ee1bc64703864781ffd8b93145c58a82078342b8097cefACRStealer/Amatera unpacked sample
- sha2564c35c4ca7a9c5170587e4e8f0100f3730082e2a872e74129e38f26d3107e7e0cACRStealer/Amatera unpacked sample
- sha256510ce9e01292433f1e1163abb6a8896e3ebb2269a0489fa91a1dec7d54fec5c9ACRStealer/Amatera unpacked sample
- sha25655fd126063af89eb1c5639a56dcf365f2e817813a45758b3f12a18f12d5561d1RemusStealer sample
- sha2565b5434cc8bb3556075c6967d2ffee5a6b33793de07b9d4701bc63d369de63861AuraStealer infostealer sample observed July 2026
- sha256608057bea6ee1cc68c1f1bdcbe702a3558270d8f19cc329b8b34bcd133984da8RemusStealer sample
- sha256641bcdaec2580058bfcbf8415ae123c7d9907c688cb107df79e20024e3bc23e2ACRStealer/Amatera unpacked sample
- sha2566530b7c8d9c8a48d16c94670cc9755f09b0d09efa92d65fbd1f9c7ebadce6630AuraStealer sample
- sha25667cd5f1b19d33786a9f73b630357cce0d90d6771590ccb965fb331ffc6d4fb94RemusStealer sample
- sha25669a11394f6ee9d2af144f57d47632806f0760d5f1bdb69310a000b436ee3b5bcACRStealer/Amatera unpacked sample
- sha25669d4b349416a93227b332b50a0d6aa38ec522d528f31f4400f248b247fd607e3ACRStealer/Amatera packed sample
- sha2566f737981ac722be8ae1c05a295667d050abe1b45dd946e1dbf4c46467c517c5fRemusStealer sample
- sha256730e9e0bd0a41438d7d7af227f1441b4f9d8a54988e0add3a2e0fbd7312cc163AuraStealer sample
- sha256758769a19ce049454101441e8d9e29b02c13a62146a43fa7b5692cff09ddf302AuraStealer sample
- sha2567e1e424f3c184c3c037235494158be38a9e7b15e0bd4a97c7f854ab03a1f09edRemusStealer sample
- sha2568049545b6d7e2ae529a6c754c555164a79b4ebe90da7c56155c9a4282c01304dACRStealer/Amatera unpacked sample
- sha25684b8ec2f3b29a10f88d21fc7617cdfecac1c2c76303086b41471beb5f563f65cRemusStealer sample
- sha25686e69bc51a02e619fcae64815445b5d8232d38361d3b055677687621e9b29c7aACRStealer/Amatera unpacked sample
- sha256900b639b26e321b308ecff93998ee33637bde2a9e198b42208ab70ff9dabe35eACRStealer/Amatera unpacked sample
- sha25693389f4234f81358fa29c65473b5bfc3c60ab7b3c2189185988f03a66aeda66fAuraStealer sample
- sha2569935b9d36e8b6ac544a9a990bcccda8eb346596fbbcb5259bc929835b737c4d2RemusStealer sample
- sha25699830a24d6aed654adff341b2c6ad2ba6c971c028dfce1ca455a37d1fbdf4617RemusStealer sample
- sha2569d02336c331bd335887c04ee466be41bc1a2a7e9069a9e9aaca2765484af0f14ACRStealer/Amatera unpacked sample
- sha2569d93afbd9c5718fe14d9f24a080e8debc6b83f6596babe0aad1b3a9cb5013d01ACRStealer/Amatera unpacked sample
- sha2569e77a7733be97f17a64c949ef061c9fe5b23ebf3b8a171cad8f4f094ecf62fc8AuraStealer sample
- sha256a6382ab6244d3d36036280e1ec3e438f442759b6917e6bc19bcb29f1d3d7e9eeAuraStealer sample
- sha256a683c423efa53f048b26c3b1c530e2598d7b55833fbe3b198cd5f13a9986fb42ACRStealer/Amatera unpacked sample
- sha256aa1f23f90cd08417a86783f9c0f80c31cc621e852091f2e7ad724b89f74f11c8ACRStealer/Amatera unpacked sample
- sha256aaf61581328f2df00b47971c2b3882122ab7e52416dc4ac2a9637ea8255810f7ACRStealer/Amatera unpacked sample
- sha256ab8cee7ddbeb8d937f8a6855c52cee704bb6f4a10934fcaf17544a8c31cced39RemusStealer sample
- sha256b3708f27ddaebb5f2f256416e5082de39dd48d2a9b2bf0e9076794c3c4ca8506ACRStealer/Amatera unpacked sample
- sha256b40cb47ab1775a4be4ec9b997b58bedfeb2076079df0804dc80982c0309fa9a2RemusStealer sample
- sha256b7c682fc6e8ea93f44c2c86fcd06e664971f42e8290a534c65a32a92d9b53a14RemusStealer sample
- sha256b8663c9c2832b92095660d1c674835acb12804e56839451e6ad9e78ed3c6d5dfAuraStealer sample
- sha256bce365972cd411ba22eb09d29792d6bb52dc485be9552a45200502e168d733b5ACRStealer/Amatera unpacked sample
- sha256bfad1100bc3054dd26151c7acea412960ece04c3aa075ba323c10cf75c31a9a4AuraStealer sample
- sha256c1e0d2c9e04fcdb10ff2d4565758ceda1331fc80def548742a79b60be81da9b9RemusStealer sample
- sha256c42849a90763133a57b4e543a4af231837e54835d3ba9a5cd9130b9d66ea3baeACRStealer/Amatera unpacked sample
- sha256c45357593df7614af68592c0f1ef578f824dc6c9d82f7a6198b21be7c06a57d6ACRStealer/Amatera unpacked sample
- sha256c805579d25000e5270305c926dee6fcc108efede9195c2bb442a6662ddaca995AuraStealer sample
- sha256cd7c5860e0e6bdbc49ae5f07d85989469a41a108dede6f6086541d276ccc155fRemusStealer sample
- sha256d3b08fd3ce1ca451b1dffd00c657b6ac1ad8ad769171faa1ba9688b572283d32RemusStealer sample
- sha256d7979fb0377c30a5361cd3f2f934c1e058a5c86031792dc66eeb24d6d7569661ACRStealer/Amatera unpacked sample
- sha256dbd1aae6e2a47af68e987dbfcc91c564d17c532e892938983eac8f891dec81b9RemusStealer sample
- sha256dd412434f9fb3d06b009c6e793938e88ab7edf71bf3180753edbcc5f1702f18eACRStealer/Amatera unpacked sample
- sha256de0d703c69ec8421a5351dc02735179aee12e8257b5816108feda8716b695b49RemusStealer sample
- sha256e2c92e4a8d22fc18a4e7510fc7ea4a207be80c5028bdc25f2aa06f7aa21627dbACRStealer/Amatera unpacked sample
- sha256e37280893d138dcc18a14ae4f5e4a13d71419da82ba978d7dcad510af95e86aaACRStealer/Amatera unpacked sample
- sha256e6a771b99ea4fa87af203a786608d3f7396d1698f43242905a66e6f9539df60eACRStealer/Amatera unpacked sample
- sha256e96c774b2c8425ab237b0fb36f57a7d8cc7e782b6d4e9a99434f3d21c93d5128ACRStealer/Amatera packed sample
- sha256e99d9294331c15c7ee0f4a03f8b95eda42fa065ec7d008bc326f9d8db562c118RemusStealer sample
- sha256ecde41aae4e4477a62781afdaa25c3020af8ff03008cc75e6fa0d140428abb63ACRStealer/Amatera unpacked sample
- sha256eecf2b15c3656275f7f4d4e1e4287fee795cb857790ca7eca107efa9cd6fad30ACRStealer/Amatera packed sample
- sha256f3ef2636d9b60715c2ea7c032cfd20492b7701bfa72ed3652b2bc540760988a0RemusStealer sample
- sha256f68ba32766e087f5a6855fa7da9feea2968280a019aec31d7d173adcd4b848caRemusStealer sample
- sha256f698f7919b026700cc2a2a9166258b8770ab9412122207f7b955fb97d249b8b9ACRStealer/Amatera packed sample
- sha256fc8a7102ed41830084bcd7c4176a93366ad3c9ce0662cb006f15f01f763cb260RemusStealer sample
- urlhxxp://158[.]94[.]208[.]7/files/8705834433/8njNDcy[.]exeAuraStealer payload download URL
- urlhxxp://158[.]94[.]211[.]222/files/1660459253/W3Trdgs[.]exeAuraStealer payload download URL
- urlhxxp://158[.]94[.]211[.]222/files/bur/fast[.]exeAuraStealer payload download URL
- urlhxxp://85[.]239[.]147[.]6/files/5851730241/IQEr4wy[.]exeAuraStealer payload download URL
- urlhxxp://85[.]239[.]147[.]6/files/Leetootoo/random[.]exeAuraStealer payload download URL
- urlhxxp://91[.]92[.]241[.]243/files/file_391c1e83ac309020[.]exeAuraStealer payload download URL
- urlhxxp://91[.]92[.]242[.]236/files-129312398/files/file_03e1dd22b8ec149f[.]exeAuraStealer payload download URL serving malicious executable
- urlhxxp://azurhay[.]shop:8539RemusStealer C2 URL on non-standard port 8539
- urlhxxp://carogra[.]biz:4219RemusStealer C2 URL on non-standard port
- urlhxxp://fimmora[.]surf:6504RemusStealer C2 URL on non-standard port
- urlhxxp://freshis[.]biz:7752RemusStealer C2 URL on non-standard port
- urlhxxp://hooiuse[.]click:4938RemusStealer C2 URL on non-standard port
- urlhxxp://myrtler[.]biz:9549RemusStealer C2 URL on non-standard port
- urlhxxp://onesdto[.]shop:2535RemusStealer C2 URL on non-standard port
- urlhxxp://slyfogx[.]shop:5776RemusStealer C2 URL on non-standard port
- urlhxxp://topxgax[.]click:4930RemusStealer C2 URL on non-standard port
- urlhxxp://tzpx[.]courses:4437RemusStealer C2 URL on non-standard port
- urlhxxp://uiccvbk[.]click:8839RemusStealer C2 URL on non-standard port
- urlhxxp://youngel[.]biz:8768RemusStealer C2 URL on non-standard port
- urlhxxp://zelpx[.]garden:9895RemusStealer C2 URL on non-standard port
Detection / Hunteropenrouter
What Happened
Criminals are renting ready-made malware called infostealers to steal passwords, cryptocurrency wallets, and other sensitive data from computers. Three specific malware families were identified as particularly active: AuraStealer, ACRStealer, and RemusStealer, with over a thousand unique samples found between June and August 2026. These programs spread through fake website verification prompts, manipulated search engine results, and malicious advertisements. Anyone who browses the web or manages cryptocurrency on a computer could be affected. The stolen data gives criminals access to bank accounts, email, and other important services. Individuals and organizations should verify website authenticity, avoid running commands from untrusted sources, and use security software to detect these threats.
Key Takeaways
- Three active infostealer MaaS families identified: AuraStealer, ACRStealer/Amatera, and RemusStealer with 1,110 unique samples combined between June and August 2026
- RemusStealer uses Etherhiding via Ethereum smart contracts for C2 domain resolution, making C2 traffic harder to detect and block through traditional network controls
- AuraStealer adopted virtualization-based obfuscation in summer 2026, increasing file size from 500-700KB to 10MB to evade analysis
- Distribution methods include ClickFix, ClearFake, SEO poisoning, malvertising, and malicious short form videos on social media
- All three families target browser credentials and crypto wallets, with ties to CIS countries and Russian language hacking forums
Affected Systems
- Windows systems (implied by .exe payloads and process injection techniques)
- Web browsers (credential and cookie theft)
- Cryptocurrency wallet applications
- Organizations in healthcare, financial, government, MSP, and tech sectors (RemusStealer targeting)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Social engineering via ClickFix, ClearFake, SEO poisoning, or malvertising tricks victim into downloading malware
- Execution: Victim runs malicious payload, often through fake reCAPTCHA verification or clipboard injection via JavaScript
- Defense Evasion: Malware uses virtualization (AuraStealer), VMProtect (Remus), string obfuscation, and anti-analysis checks to avoid detection
- Credential Access: Infostealer harvests credentials from browsers, crypto wallets, session tokens, and application data
- C2 Communication: RemusStealer uses Ethereum smart contracts (Etherhiding) for C2 domain resolution; AuraStealer and ACRStealer use traditional C2 domains
- Exfiltration: Collected data exfiltrated to attacker-controlled C2 servers
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any detection rules, queries, or signatures. It provides IOCs including file hashes, C2 domains, URLs, and IP addresses that can be used to build custom detections.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Process injection and virtualization can be detected by EDR but anti-analysis features and VMProtect packing may cause some tools to miss samples. AuraStealer's virtualization increases file size to 10MB which may trigger some heuristics. |
| Network Visibility | Medium | C2 domains and URLs are listed with non-standard ports but Etherhiding via Ethereum smart contracts makes RemusStealer C2 harder to detect through traditional network monitoring. DNS queries to blockchain API endpoints may not be flagged. |
| Detection Difficulty | Moderate | IOCs are available across all three families but evasion techniques including virtualization, VMProtect packing, and Etherhiding increase detection difficulty. Non-standard C2 ports and blockchain-based C2 resolution require non-traditional detection approaches. |
Required Log Sources
- EDR process telemetry
- DNS resolution logs
- Web proxy logs
- Firewall logs with destination port information
- Browser security extension logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Processes accessing browser credential stores and crypto wallet application data directories may indicate infostealer activity | EDR process telemetry showing file access patterns to browser data directories | Credential Access | Medium - legitimate password managers and browser extensions also access these locations |
| Network connections to domains on non-standard high ports may indicate infostealer C2 communication | Firewall logs and proxy logs showing destination ports and domain resolution | Command and Control | Medium - some legitimate services use non-standard ports |
| Large executable files exceeding 10MB with virtualization or packing characteristics may indicate AuraStealer samples | EDR file creation events with size and entropy analysis | Defense Evasion | Low - 10MB executables with high entropy are uncommon in typical environments |
| Processes making DNS queries to Ethereum blockchain API endpoints followed by connections to dynamically resolved domains may indicate Etherhiding C2 | DNS logs and network flow data showing blockchain API queries preceding new domain connections | Command and Control | Low - blockchain API queries from non-cryptocurrency applications are unusual |
| Clipboard modification events triggered by JavaScript or browser processes may indicate ClearFake social engineering | EDR clipboard monitoring and browser process telemetry | Execution | Medium - legitimate clipboard managers and browser extensions modify clipboard contents |
Control Gaps
- Signature-based antivirus may miss virtualized or VMProtect-packed samples
- Traditional network controls may not detect Etherhiding C2 communication via Ethereum smart contracts
- DNS filtering may not catch dynamically resolved C2 domains from blockchain infrastructure
- Browser-based security controls may not detect credential theft from local browser stores
- Network firewalls may not block C2 traffic on non-standard high ports without explicit rules
Key Behavioral Indicators
- Processes accessing browser credential storage locations (T1555.003)
- Network connections to domains on non-standard high ports (T1071)
- Large executable files with virtualization or packing signatures (T1027.002)
- DNS queries to blockchain API endpoints followed by new domain connections
- Clipboard modification events triggered by JavaScript (T1059.001)
- Process injection and hollowing behavior patterns (T1055.012)
- Prompt boxes requesting randomized string input before execution, indicating anti-analysis checks
False Positive Assessment
Medium - C2 domains use common TLDs and non-standard ports that may overlap with legitimate services. Browser credential access by legitimate password managers could trigger false positives. Clipboard modification by legitimate browser extensions is common. Some C2 domain names resemble legitimate software tooling domains.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the listed C2 domains and download server IPs at network perimeter controls if supported by your infrastructure.
- Consider adding the provided file hashes to endpoint detection blocklists if your EDR or AV solution supports custom hash-based blocking.
- If your web proxy supports URL filtering, consider blocking the listed download URLs and C2 URLs, particularly those using non-standard ports.
Infrastructure Hardening
- Evaluate whether DNS filtering can block queries to the listed C2 domains and their associated TLDs (.cfd, .cc, .shop, .biz, .click, .surf, .courses, .garden).
- Consider implementing network rules to block outbound connections on non-standard high ports used by RemusStealer C2 servers.
- If applicable, evaluate whether blockchain API endpoints used for Etherhiding can be monitored or restricted on your network.
User Protection
- Consider deploying browser security extensions that alert on credential access by untrusted processes.
- Evaluate whether endpoint controls can detect and block clipboard modification by JavaScript or untrusted applications.
- If supported by your EDR, consider enabling behavioral detection for process injection and hollowing techniques.
Security Awareness
- Consider incorporating ClickFix and ClearFake social engineering techniques into existing security awareness training programs.
- Educate users on verifying website authenticity and avoiding fake reCAPTCHA verification prompts that request command execution.
- Consider advising users to be cautious of software downloads from search engine results, particularly for tools related to software development.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping13 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Ips:
91[.]92[.]241[.]243- AuraStealer payload download server85[.]239[.]147[.]6- AuraStealer payload download server hosting multiple malicious executables158[.]94[.]208[.]7- AuraStealer payload download server158[.]94[.]211[.]222- AuraStealer payload download server hosting multiple malicious executables
- Domains:
zkevopenanu[.]cfd- AuraStealer C2 domaindev-tools[.]cfd- AuraStealer C2 domainsys-tools[.]cfd- AuraStealer C2 domainaewaterdelivery[.]com- AuraStealer C2 domainsecupd[.]cfd- AuraStealer C2 domainmemaiagent[.]cfd- AuraStealer C2 domainlogin[.]metricsdashboard[.]cc- ACRStealer/Amatera C2 domainstatic[.]quorashift[.]cc- ACRStealer/Amatera C2 domaindata[.]nomadhive[.]cc- ACRStealer/Amatera C2 domainauth[.]automationportal[.]cc- ACRStealer/Amatera C2 domainwss[.]vectorplatform[.]cc- ACRStealer/Amatera C2 domainedge[.]kernelmonitor[.]cc- ACRStealer/Amatera C2 domainstream[.]pawpalace[.]cc- ACRStealer/Amatera C2 domainres[.]explicittweak[.]cc- ACRStealer/Amatera C2 domaincarogra[.]biz- RemusStealer C2 domain on port 4219fimmora[.]surf- RemusStealer C2 domain on port 6504freshis[.]biz- RemusStealer C2 domain on port 7752hooiuse[.]click- RemusStealer C2 domain on port 4938myrtler[.]biz- RemusStealer C2 domain on port 9549onesdto[.]shop- RemusStealer C2 domain on port 2535slyfogx[.]shop- RemusStealer C2 domain on port 5776topxgax[.]click- RemusStealer C2 domain on port 4930tzpx[.]courses- RemusStealer C2 domain on port 4437uiccvbk[.]click- RemusStealer C2 domain on port 8839youngel[.]biz- RemusStealer C2 domain on port 8768zelpx[.]garden- RemusStealer C2 domain on port 9895
- Urls:
hxxp://91[.]92[.]241[.]243/files/file_391c1e83ac309020.exe- AuraStealer payload download URLhxxp://85[.]239[.]147[.]6/files/Leetootoo/random.exe- AuraStealer payload download URLhxxp://85[.]239[.]147[.]6/files/5851730241/IQEr4wy.exe- AuraStealer payload download URLhxxp://158[.]94[.]208[.]7/files/8705834433/8njNDcy.exe- AuraStealer payload download URLhxxp://158[.]94[.]211[.]222/files/1660459253/W3Trdgs.exe- AuraStealer payload download URLhxxp://158[.]94[.]211[.]222/files/bur/fast.exe- AuraStealer payload download URLhxxp://carogra[.]biz:4219- RemusStealer C2 URL on non-standard porthxxp://fimmora[.]surf:6504- RemusStealer C2 URL on non-standard porthxxp://freshis[.]biz:7752- RemusStealer C2 URL on non-standard porthxxp://hooiuse[.]click:4938- RemusStealer C2 URL on non-standard porthxxp://myrtler[.]biz:9549- RemusStealer C2 URL on non-standard porthxxp://onesdto[.]shop:2535- RemusStealer C2 URL on non-standard porthxxp://slyfogx[.]shop:5776- RemusStealer C2 URL on non-standard porthxxp://topxgax[.]click:4930- RemusStealer C2 URL on non-standard porthxxp://tzpx[.]courses:4437- RemusStealer C2 URL on non-standard porthxxp://uiccvbk[.]click:8839- RemusStealer C2 URL on non-standard porthxxp://youngel[.]biz:8768- RemusStealer C2 URL on non-standard porthxxp://zelpx[.]garden:9895- RemusStealer C2 URL on non-standard port
- File Hashes:
bfad1100bc3054dd26151c7acea412960ece04c3aa075ba323c10cf75c31a9a4(SHA256) - AuraStealer sampleb8663c9c2832b92095660d1c674835acb12804e56839451e6ad9e78ed3c6d5df(SHA256) - AuraStealer sample134ab4b33ab555f3a77d43e94891698834a9b739b065764a702c7c52e3f4c15b(SHA256) - AuraStealer samplea6382ab6244d3d36036280e1ec3e438f442759b6917e6bc19bcb29f1d3d7e9ee(SHA256) - AuraStealer sample3575caf8bd87912689ebb1d13770990248f93c5d882db8c849bee02cb7c0abad(SHA256) - AuraStealer sample93389f4234f81358fa29c65473b5bfc3c60ab7b3c2189185988f03a66aeda66f(SHA256) - AuraStealer sample01718933eb502e4ec9d4b1210a88cb026882d615605dd8d7fbf1c4057b7c0867(SHA256) - AuraStealer sample397566a51d405c351e5134650463d5872e218682f7f34a5f314539d087837ea4(SHA256) - AuraStealer sample3efc1f87e3f0566daef895ddccf21dff9eb70fbea17ec7d60ba7fdceb35c1b5c(SHA256) - AuraStealer sample36cfccc84b21d9bb8b3eb93589870aea0b146fd9ba649b785d44bb8dafd82656(SHA256) - AuraStealer sample758769a19ce049454101441e8d9e29b02c13a62146a43fa7b5692cff09ddf302(SHA256) - AuraStealer sample6530b7c8d9c8a48d16c94670cc9755f09b0d09efa92d65fbd1f9c7ebadce6630(SHA256) - AuraStealer samplec805579d25000e5270305c926dee6fcc108efede9195c2bb442a6662ddaca995(SHA256) - AuraStealer sample9e77a7733be97f17a64c949ef061c9fe5b23ebf3b8a171cad8f4f094ecf62fc8(SHA256) - AuraStealer sample730e9e0bd0a41438d7d7af227f1441b4f9d8a54988e0add3a2e0fbd7312cc163(SHA256) - AuraStealer samplec4831ec2b68c576199245eb877e83f9b5e83dd3f(SHA1) - AuraStealer dropped/downloaded file1c24da264bce471366156b4721bacb83201ba759(SHA1) - AuraStealer dropped/downloaded file7c0f669cd06e5ba8fdcdba107b9519fe73519368(SHA1) - AuraStealer dropped/downloaded filee96c774b2c8425ab237b0fb36f57a7d8cc7e782b6d4e9a99434f3d21c93d5128(SHA256) - ACRStealer/Amatera packed sample1019d8a20bd7732b2c2747b30646a5d10725fd5ee532b5e858dab27ba150db1e(SHA256) - ACRStealer/Amatera packed sample06f6a0dc417bf0c8d1fa54754f53d37d190a3b9bf66658e00a630ae0bb56dfab(SHA256) - ACRStealer/Amatera packed sampleeecf2b15c3656275f7f4d4e1e4287fee795cb857790ca7eca107efa9cd6fad30(SHA256) - ACRStealer/Amatera packed sample2ab248b392653566fe4fb34e2ced50acd8e91941010f38e2a85c792968261f20(SHA256) - ACRStealer/Amatera packed sample69d4b349416a93227b332b50a0d6aa38ec522d528f31f4400f248b247fd607e3(SHA256) - ACRStealer/Amatera packed samplef698f7919b026700cc2a2a9166258b8770ab9412122207f7b955fb97d249b8b9(SHA256) - ACRStealer/Amatera packed sample41b3e4f80aa2deeaf56c5181cd3fc1b2ee545d053d29934408bb17ddd7ea2096(SHA256) - ACRStealer/Amatera packed sampled7979fb0377c30a5361cd3f2f934c1e058a5c86031792dc66eeb24d6d7569661(SHA256) - ACRStealer/Amatera unpacked sample4332227474b0d7db91a1e156ac3afa58ea4973ff00cb455dfd073fa1ec6dabcd(SHA256) - ACRStealer/Amatera unpacked sample69a11394f6ee9d2af144f57d47632806f0760d5f1bdb69310a000b436ee3b5bc(SHA256) - ACRStealer/Amatera unpacked sample9d02336c331bd335887c04ee466be41bc1a2a7e9069a9e9aaca2765484af0f14(SHA256) - ACRStealer/Amatera unpacked sampleb3708f27ddaebb5f2f256416e5082de39dd48d2a9b2bf0e9076794c3c4ca8506(SHA256) - ACRStealer/Amatera unpacked sampleaa1f23f90cd08417a86783f9c0f80c31cc621e852091f2e7ad724b89f74f11c8(SHA256) - ACRStealer/Amatera unpacked sample510ce9e01292433f1e1163abb6a8896e3ebb2269a0489fa91a1dec7d54fec5c9(SHA256) - ACRStealer/Amatera unpacked sample21c11f37cbf8365d26d243515cd23e822ecfa1d25f3262b62ffb1085efd09d9c(SHA256) - ACRStealer/Amatera unpacked sample242871749873401e97d2651c5bc1c874ae9a3832a1c14b48630390dff0acafc0(SHA256) - ACRStealer/Amatera unpacked sample9d93afbd9c5718fe14d9f24a080e8debc6b83f6596babe0aad1b3a9cb5013d01(SHA256) - ACRStealer/Amatera unpacked sample0fac8922b1afc82d02b7a2d059ec6964a0b29196166b1377d165c08e134400db(SHA256) - ACRStealer/Amatera unpacked samplec45357593df7614af68592c0f1ef578f824dc6c9d82f7a6198b21be7c06a57d6(SHA256) - ACRStealer/Amatera unpacked sample900b639b26e321b308ecff93998ee33637bde2a9e198b42208ab70ff9dabe35e(SHA256) - ACRStealer/Amatera unpacked samplee37280893d138dcc18a14ae4f5e4a13d71419da82ba978d7dcad510af95e86aa(SHA256) - ACRStealer/Amatera unpacked sample2abb2d9250e78af3b0636a83f6031a14512d7d891e34a043cafc771f2ac3ea12(SHA256) - ACRStealer/Amatera unpacked sample167873a847a2b996bd3b44b38c819768274efda6daf2978532c7b6b4f1a0acb1(SHA256) - ACRStealer/Amatera unpacked sample127bfec23f77b6c9f2addd7f1fe8016b41078c8dbdda34737f7cb6b5563ec22b(SHA256) - ACRStealer/Amatera unpacked sample4a3cf2cd75d78359f4ee1bc64703864781ffd8b93145c58a82078342b8097cef(SHA256) - ACRStealer/Amatera unpacked sample641bcdaec2580058bfcbf8415ae123c7d9907c688cb107df79e20024e3bc23e2(SHA256) - ACRStealer/Amatera unpacked sampleecde41aae4e4477a62781afdaa25c3020af8ff03008cc75e6fa0d140428abb63(SHA256) - ACRStealer/Amatera unpacked sample252ad5844e88d5e3da533f8d913442cdc72d018ed29594a994e19a403026aa0d(SHA256) - ACRStealer/Amatera unpacked sample377e1b540fd76b28638231ca69f955130768ea9de045e6af18b6e5b88e59211d(SHA256) - ACRStealer/Amatera unpacked sample4c35c4ca7a9c5170587e4e8f0100f3730082e2a872e74129e38f26d3107e7e0c(SHA256) - ACRStealer/Amatera unpacked sample8049545b6d7e2ae529a6c754c555164a79b4ebe90da7c56155c9a4282c01304d(SHA256) - ACRStealer/Amatera unpacked samplee2c92e4a8d22fc18a4e7510fc7ea4a207be80c5028bdc25f2aa06f7aa21627db(SHA256) - ACRStealer/Amatera unpacked samplea683c423efa53f048b26c3b1c530e2598d7b55833fbe3b198cd5f13a9986fb42(SHA256) - ACRStealer/Amatera unpacked sampleaaf61581328f2df00b47971c2b3882122ab7e52416dc4ac2a9637ea8255810f7(SHA256) - ACRStealer/Amatera unpacked sample3fa65bbadec7e0d448b4d167ac48399f1f9a0966d5574b25876169171a204aba(SHA256) - ACRStealer/Amatera unpacked samplebce365972cd411ba22eb09d29792d6bb52dc485be9552a45200502e168d733b5(SHA256) - ACRStealer/Amatera unpacked sample47a7a38d8e7d729aa0d9312fae2ebd13b7c11a5ae91474a883b7ceb56298f395(SHA256) - ACRStealer/Amatera unpacked sample86e69bc51a02e619fcae64815445b5d8232d38361d3b055677687621e9b29c7a(SHA256) - ACRStealer/Amatera unpacked sampledd412434f9fb3d06b009c6e793938e88ab7edf71bf3180753edbcc5f1702f18e(SHA256) - ACRStealer/Amatera unpacked samplee6a771b99ea4fa87af203a786608d3f7396d1698f43242905a66e6f9539df60e(SHA256) - ACRStealer/Amatera unpacked sample5ce36e61c71aa43b274142d8be1cb6e384ed52336d7b76d06a761534c0da8c4(SHA256) - ACRStealer/Amatera unpacked samplec42849a90763133a57b4e543a4af231837e54835d3ba9a5cd9130b9d66ea3bae(SHA256) - ACRStealer/Amatera unpacked sample450216a711f8b3371a2936923201f204fa1c686a2b831dac4a1c0094c105a5fd(SHA256) - RemusStealer sample000b7533d53d0feed7cd995043a4298fe2b8c5767c1ffff7710f446c682928cb(SHA256) - RemusStealer sample2f029858b8ecca8fb6c156eb2d046a2463e8b67d356c1003e5567339681a71be(SHA256) - RemusStealer sample48b82c79a90ed401449260948b269d0909bbdb53847678dfbba09c368016bd7e(SHA256) - RemusStealer sample608057bea6ee1cc68c1f1bdcbe702a3558270d8f19cc329b8b34bcd133984da8(SHA256) - RemusStealer sample6f737981ac722be8ae1c05a295667d050abe1b45dd946e1dbf4c46467c517c5f(SHA256) - RemusStealer sample55fd126063af89eb1c5639a56dcf365f2e817813a45758b3f12a18f12d5561d1(SHA256) - RemusStealer sample47d5a5ef1afe3d1b8dbfde026a80d97ed0e012c144fa3940bb39758de75ca842(SHA256) - RemusStealer sample67cd5f1b19d33786a9f73b630357cce0d90d6771590ccb965fb331ffc6d4fb94(SHA256) - RemusStealer sample9935b9d36e8b6ac544a9a990bcccda8eb346596fbbcb5259bc929835b737c4d2(SHA256) - RemusStealer sample7e1e424f3c184c3c037235494158be38a9e7b15e0bd4a97c7f854ab03a1f09ed(SHA256) - RemusStealer sample84b8ec2f3b29a10f88d21fc7617cdfecac1c2c76303086b41471beb5f563f65c(SHA256) - RemusStealer sample99830a24d6aed654adff341b2c6ad2ba6c971c028dfce1ca455a37d1fbdf4617(SHA256) - RemusStealer sampleab8cee7ddbeb8d937f8a6855c52cee704bb6f4a10934fcaf17544a8c31cced39(SHA256) - RemusStealer sampleb7c682fc6e8ea93f44c2c86fcd06e664971f42e8290a534c65a32a92d9b53a14(SHA256) - RemusStealer sampleb40cb47ab1775a4be4ec9b997b58bedfeb2076079df0804dc80982c0309fa9a2(SHA256) - RemusStealer samplec1e0d2c9e04fcdb10ff2d4565758ceda1331fc80def548742a79b60be81da9b9(SHA256) - RemusStealer sampled3b08fd3ce1ca451b1dffd00c657b6ac1ad8ad769171faa1ba9688b572283d32(SHA256) - RemusStealer samplecd7c5860e0e6bdbc49ae5f07d85989469a41a108dede6f6086541d276ccc155f(SHA256) - RemusStealer samplee99d9294331c15c7ee0f4a03f8b95eda42fa065ec7d008bc326f9d8db562c118(SHA256) - RemusStealer samplede0d703c69ec8421a5351dc02735179aee12e8257b5816108feda8716b695b49(SHA256) - RemusStealer sampledbd1aae6e2a47af68e987dbfcc91c564d17c532e892938983eac8f891dec81b9(SHA256) - RemusStealer samplef68ba32766e087f5a6855fa7da9feea2968280a019aec31d7d173adcd4b848ca(SHA256) - RemusStealer samplef3ef2636d9b60715c2ea7c032cfd20492b7701bfa72ed3652b2bc540760988a0(SHA256) - RemusStealer samplefc8a7102ed41830084bcd7c4176a93366ad3c9ce0662cb006f15f01f763cb260(SHA256) - RemusStealer sample