aura_stealer | 9a46c8d884f4c59701d3af7bead1e099e3ddeb1e2b75f98756cc5403d88bd370

Resubmissions

29/01/2026, 19:54

260129-ymhdesew8b10

22/01/2026, 14:59

260122-scte2set4d10

Sharing

Copy URL Twitter E-mail

General

Target
9a46c8d884f4c59701d3af7bead1e099e3ddeb1e2b75f98756cc5403d88bd370
Size 633KB
Sample260122-scte2set4d
SHA256 9a46c8d884f4c59701d3af7bead1e099e3ddeb1e2b75f98756cc5403d88bd370
MD5 fa3ba7b470e2514798a4b621806af5f9
SHA1 e4222c2405fc3abf7079bdaa6d4ddac87ca7435a
SHA512 6c46c7f22f0d3eddf8d35ffbfda7c0fa18f166fe09471bbea25bae6d2f67295f6535422e384ade4048ab78ecd83b12eb604b0b140ac74af2bb87f9f8e2fd91b8
SSDEEP 12288:9gJwyIxwO2QUqW1w6vV6gHjuWM7bdeQS+Zp:9QwEO2QSw6vUgHju7Zz
TLSH
T17CD49E22FDC390F8F0B31531559DF33ADB3A3E06DE11969BE7D0AB54EA70211A92650B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aura_stealer

Malware Config

Extracted

Family

aura_stealer

Version

1.1.1

https://armydevice.shop

Attributes

anti_dbg
true
anti_vm
false
build_id
9f68f5e2-88d7-4d69-b5f4-4e45949ceca4
human_check
false
self_del
false
useragents

Signatures

Aura_stealer family
aura_stealer

Detects AuraStealer stealer 1 IoCs

resource	yara_rule
sample	family_aura_stealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a46c8d884f4c59701d3af7bead1e099e3ddeb1e2b75f98756cc5403d88bd370

File Explorer

9a46c8d884f4c59701d3af7bead1e099e3ddeb1e2b75f98756cc5403d88bd370

.exe 633KB

9a46c8d884f4c59701d3af7bead1e099e3ddeb1e2b75f98756cc5403d88bd370

IMPHASH ac541680029765250d758d3a0667066d
SHA256 9a46c8d884f4c59701d3af7bead1e099e3ddeb1e2b75f98756cc5403d88bd370
MD5 fa3ba7b470e2514798a4b621806af5f9
SHA1 e4222c2405fc3abf7079bdaa6d4ddac87ca7435a
SHA512 6c46c7f22f0d3eddf8d35ffbfda7c0fa18f166fe09471bbea25bae6d2f67295f6535422e384ade4048ab78ecd83b12eb604b0b140ac74af2bb87f9f8e2fd91b8
SSDEEP 12288:9gJwyIxwO2QUqW1w6vV6gHjuWM7bdeQS+Zp:9QwEO2QSw6vUgHju7Zz
TLSH
T17CD49E22FDC390F8F0B31531559DF33ADB3A3E06DE11969BE7D0AB54EA70211A92650B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects AuraStealer stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

362588

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockShared AreFileApisANSI CloseHandle CompareStringW CreateDirectoryW CreateFileW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemPowerStatus GetSystemTimeAsFileTime GetTempPathW GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockShared RtlUnwind SetEndOfFile SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc WideCharToMultiByte WriteConsoleW WriteFile

advapi32

AllocateAndInitializeSid CredFree CredReadA EqualSid FreeSid GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW

user32

EnumDisplayDevicesW GetKeyboardLayoutList GetSystemMetrics

shell32

ShellExecuteExW

crypt32

CryptStringToBinaryA CryptUnprotectData

ws2_32

WSACleanup WSAStartup closesocket connect htons socket

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryAuthSchemes WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetCredentials WinHttpWriteData

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSaveImageToStream