Loading malware…
Aura is a Windows information-stealing malware family written in native C++ and operated as a malware-as-a-service offering since July 2025. It emerged in criminal markets as a post-Lumma replacement and has been marketed to the same buyer ecosystem, with operators claiming adoption by users of other stealer families including Lumma, StealC, Vidar, and Rhadamanthys. Aura has been publicly promoted on multiple underground forums and positioned as a commercially supported stealer service.
Aura is designed to collect a broad range of victim data and exfiltrate structured reports to its command infrastructure. Its functionality includes theft of browser data from Chromium- and Gecko-based browsers, collection of cookies and other browser artifacts, system profiling, process and installed-software enumeration, screenshot capture, and file-grabber tasks targeting numerous categories of applications. Observed tasking has included theft from cryptocurrency wallets, VPN clients, password managers, messaging applications, remote-access tools, gaming platforms, and authentication software. Aura also implements hardware and host fingerprinting to identify infected systems.
The malware uses layered anti-analysis and obfuscation techniques intended to frustrate static and dynamic analysis. Reported protections include patched PE security characteristics, constructor-based anti-sandbox execution before the main program entry point, anti-debugging checks, breakpoint detection, username and process blacklist checks, runtime API resolution through hashing, encrypted strings, encrypted embedded configuration data, and 32-bit to 64-bit execution transitions using Heaven's Gate techniques. Aura can enforce single-instance execution with a mutex and includes optional self-deletion behavior. Operators have also indicated interest in further hardening builds with code virtualization.
Aura communicates with its backend over WinHTTP, performing heartbeat and configuration retrieval operations and receiving substantial portions of its stealing task list from the server at runtime rather than embedding all targets in the binary. Although it uses AES-256-CBC for message wrapping, reported implementations expose the session key and IV within each message, making transport confidentiality dependent primarily on TLS rather than the malware's own cryptographic design.
The malware includes regional exclusion logic associated with CIS countries, implemented through host- and server-side checks, and operators have stated that this restriction is intentional. Aura has also been observed as a payload delivered through ClickFix-style social-engineering campaigns, including social-media lures that trick users into executing malicious commands. Overall, Aura is best characterized as a commercially operated infostealer focused on credential and session data theft, broad application data harvesting, and resilient evasion of automated analysis.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
At the moment, we have a code virtualization module ready, which we have not yet specifically implemented in our builds so that they can be researched. After several interesting technical reports appear, we will completely virtualize our code, and analyzing it will become a very difficult task.
The hash table is populated during init via GetModuleHandleA("ntdll.dll") and LdrGetProcedureAddress, with API addresses stored XOR-encrypted... The binary resolves 100+ APIs at runtime through the FNV-1a hash table and CFF dispatch.
When self_del is true in the config, the binary wipes and deletes itself after exfiltration... cmd.exe /c taskkill /f /im <process> & fsutil file setZeroData offset=0 length=<size> <path> & del /f /q <path>
Every Aura sample crashes in the Triage sandbox. The anti-sandbox code runs in global constructors (_initterm_e), not in WinMain... One or more of them contain: MapFileAndCheckSumW binary integrity verification, Software breakpoint detection on return addresses, Anti-debug checks.
OS version data comes from the registry at SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion... The binary also calls... RegOpenKeyExW("SOFTWARE\\Microsoft\\Cryptography") + RegQueryValueExW("MachineGuid") for HWID.
Process blacklist scan via CreateToolhelp32Snapshot + Process32FirstW / Process32NextW... [Processes List] {running processes}
The binary builds a structured text document with the self-identification marker AURA... [System Info] Architecture, Language, Keyboard Layouts, Time Zone, Computer Name, User Name, Screen resolution, OS Name... [Hardware] CPU, RAM, GPUs.
The file grabber tasks target application data directories under %appdata%, %localappdata%, and %programfiles%... steal files matching glob patterns from target directories.
Every Aura sample crashes in the Triage sandbox. The anti-sandbox code runs in global constructors (_initterm_e), not in WinMain... One or more of them contain: MapFileAndCheckSumW binary integrity verification, Software breakpoint detection on return addresses, Anti-debug checks.
Heartbeat: /api/live... The binary sends a multipart POST with a single field named data containing a base64-encoded envelope... Data exfil POST /api/send.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named infostealer referenced in a malware analysis entry centered on an interview with its developers.
Native C++ information stealer sold as a service. It uses multiple obfuscation layers, anti-sandbox and anti-debug logic, runtime server-pushed tasking, and steals data from browsers, crypto wallets, VPN clients, password managers, messaging apps, and system information. It also supports screenshot capture and self-deletion.
Information-stealing malware; developer claims it includes CIS-region avoidance checks (system and IP-based) to prevent execution/operation in CIS countries.
An information-stealing malware offered as a MaaS-style product, positioned by its operators as a rapidly growing stealer with customer support, anti-CIS checks, and planned code virtualization to hinder analysis.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.