eSentire Threat Intelligence Malware Analysis: Aurora Stealer

Since December 2022, the eSentire Threat Response Unit (TRU) has observed Aurora Stealer malware infections in the manufacturing industry. It's distributed via fake Google Ads for Notepad++ installer. Aurora Stealer gathers sensitive data, including cookies, autofill information, and encrypted passwords from browsers such as Opera, Brave, Mozilla Firefox, Chrome, etc. However, it is worth noting that the stealer does not collect credentials from Mozilla Firefox.

The malware is priced at $125USD per month, $300USD for 3 months access, and $1,000USD for lifetime access. In order to avoid detection from antivirus scanners, the binary code is filled with junk bytes to increase the file size.

This malware analysis delves deeper into the technical details of how the Aurora Stealer malware operates and our security recommendations to protect your organization from being exploited.

Case Study Aurora Stealer

Drive-by downloads are becoming increasingly common as attackers find new ways to access and exfiltrate sensitive data.

Since December 2022, the eSentire Threat Response Unit (TRU) has observed several Aurora Stealer infections in the manufacturing industries. The stealer is distributed via Google Ads as a fake Notepad++ installer, TeamViewer, Nvidia Driver, etc. (Figures 1-3)

The stealer uses the Cheshire cat from Alice in Wonderland as its mascot and began appearing for sale on Russian-speaking forums in early 2022. The stealer is written in Golang, capable of stealing over 90 crypto wallets, and has an embedded Loader module that includes the downloader and PowerShell; the developer claims that the stealer does not need any dependencies to function.

The stealer also has a web panel, which does not require the operator to work directly from the dedicated server called “dedik” as slang in Russian hacking forums (Russian: дедик). The dedicated server is the one hosting the stealer and processing the logs. The stealer is priced $125 for one month of access, $300 for 3 months of access, and $1000 for lifetime access. The stealer does not work in Russia and CIS (Commonwealth of Independent States) countries (Figures 4-6).

At the time of this writing, the malware developer advertised that the pre-orders come with lifetime access to Aurora Botnet and Aurora Stealer, including all the modules such as DDoS, SiteScanner, Loader, Brute Force, PowerShell/CMD execution, etc. (Figure 7).

The cost for the pre-order is $1000. The botnet is a separate panel that allows an attacker to execute remote commands and perform specific tasks on the hosts, remote in using hVNC/HRDP/RDP/VNC (Figures 8-10).

The Aurora stealer login can also be seen in Figure 11. A snippet of the Aurora manual for setting up and leveraging the malware can be seen in Figure 12.

So, how does it spread?

Aurora Stealer is spread via installs (Russian: инсталл), also known as Pay-Per-Install (PPI) services, traffers (Russian: трафферы), or Google Ads. Pay-Per-Install (PPI) is a type of online advertising model where advertisers pay publishers a commission for every installation of their software or application that occurs as a result of the publisher's promotion. The end-user would be redirected to an attacker’s landing page (Russian slang: ленд), where they download the malicious stealer payload.

The installs can also spread the stealer via the already infected hosts. The hosts can be infected with other malware families such as RATs (Remote Access Trojans). One of the popular install services that Aurora Stealer uses is InstallLabs (Figure 13).

Traffers are groups of people that are responsible for spreading the stealers via the links to the download pages via social media platforms such as Facebook and YouTube. The worker (Russian: воркер) is the individual within the traffics group that is responsible for spreading the stealer.

How can the stealer remain undetected?

To evade antivirus scanners, the attacker(s) usually fill the stealer binary with junk bytes to increase the file size, archive, and password-protect it. Aurora Stealer allows users to pack or add junk bytes into the build (stealer payload) to increase the file size for detection and sandbox evasion (Figure 14).

The increase in the file size can significantly impact the stealer execution rate (Russian: отстук). The stealer execution rate is used to assess the quality of data transmission from the sender to the server. The better the quality of data transmission, the higher likelihood that the attacker receives all the stolen logs.

The attacker(s) can bypass SmartScreen controls by purchasing an EV certificate. SmartScreen is a security feature in Microsoft Windows that warns users about potentially unsafe websites and downloads. It uses a database of known threats and machine learning algorithms to identify new and suspicious behavior.

An EV (Extended Validation) certificate is a type of digital certificate used to authenticate and secure online communication. It verifies the identity of a website's owner and displays a green address bar in the browser to indicate that the site is trustworthy. Commonly used by financial and e-commerce websites, EV certificates are considered the highest level of validation and can be expensive to purchase (Figure 15).

EV certificates can also be used to bypass User Account Control (UAC) alerts, which is a security feature in Windows operating systems that helps prevent unauthorized changes to a computer. When a user attempts to perform an action that requires elevated permissions, such as installing software or changing system settings, a UAC alert appears on the screen, asking the user to confirm the action.

The Case of a Cheshire Cat

The infection starts with the basic reconnaissance commands spawning from wmic.exe and cmd.exe (Figure 16):

• wmic os get Caption – returns the name of the operating system installed on the computer.
• Cmd/C “wmic cpu get name” – returns the processor’s name on the computer.
• cmd /C “wmic path win_32_VideoController get name” – returns the name of the video controller on the computer.

As mentioned before, the stealer binary is written in Go Programming language, the stealer binary without any size pumping and crypting, which involves obfuscating and encrypting the binary, is 2.96 MB in size.

The Aurora developer(s) offer their own crypting service for $40/1 crypt, $300/10 crypts (Figure 17).

The function responsible for enumerating the GPU, CPU, and the caption of the operating system (gets the OS information) is shown in Figures 18-20. The gathered information is then sent to the stealer’s panel and is contained in a text file named “UserInformation”.

The stealer mainly uses win, the Windows API package for Go, to perform specific tasks such as taking the screenshot of the host using the APIs such as CompatibleBitmap, CreateCompatibleDC, GetDC, and BitBlt (Figure 21).

The stealer retrieves the GUID of the infected machine via querying for the MachineGuid parameter under SOFTWARE\Microsoft\Cryptography (Figure 22).

The functions shown below are responsible for getting the infected machine's screen size and containing the Build ID, Build Group. The collected information is also written in the “UserInformation” text file (Figure 23).

Aurora Stealer gathers sensitive data, including cookies, autofill information, and encrypted passwords from browsers such as Opera, Brave, Mozilla Firefox, Chrome, etc. The gathered information is temporarily stored under the %temp% folder (Figure 24). However, it is worth noting that the stealer does not collect credentials from Mozilla Firefox.

Under the function main_getMasterKey, we can see the references to os_crypt, encrypted_key, and DPAPI (Figure 25).

DPAPI (Data Protection Application Programming Interface) is used, for example, to store cookies and password information for Chrome browsers DPAPI uses APIs CryptProtectData and CryptUnprotectData to encrypt and decrypt data accordingly.

Chrome stores the DPAPI-encrypted AES key, which is the Master Key under os_encrypted.encrypted_key in a base64-encoded format. To be able to decrypt the saved credentials and cookies, Aurora Stealer needs to decode the base64-encoded string and call the CryptUnprotectData function, then remove the padding from the master key.

Aurora Stealer has multiple Grabber functions that are responsible for collecting additional data such as crypto wallets, screenshots, files, Telegram, etc. (Figure 26)

The stealer also grabs the files from the folder “Windows.old” which stores the backup copy of the previous Windows installation if applicable (Figure 27).

This grabber function searches for crypto wallets under AppData\Roaming (Figure 28), for example, for leveldb files that store the private keys:

• AppData\Roaming\Guarda\Local Storage\leveldb
• AppData\Roaming\atomic\Local Storage\leveldb

Below is the grabber function for the Telegram tdata folder that would let the attacker authenticate into the victim’s Telegram on the Desktop version by placing the tdata folder in the same folder as the Telegram client (Figure 29).

Just like other stealers such as Redline, Raccoon Stealer, and Vidar Stealer, Aurora Stealer has two modules: grabber and loader. The grabber module retrieves the files or folders specified by an attacker. The gathered files/folders would then be archived in a zip file named temp.zip, stored under %userprofile% (Figure 30-31).

The “END_PACKET_ALL_SEND” message is likely used for debugging logs.

The stealer stores the loader (Figure 32), grabber, and the general configuration information within the build in the base64-encoded form (Figure 33). The loader module has two options:

• Download and Run – the attacker specifies the direct download link to the additional payload.
• PowerShell – the attacker specifies the PowerShell command to run on the host.

The Loader module, where:

• DW is the downloader parameter.
• PS is the PowerShell parameter.
• UnicID is the unique identifier.
• Argument contains the loader task.

The loader downloader module pulls an executable from the file hosting server at the end of the stealer execution and places it under the %temp% folder. The stealer executes the secondary payload using “start-process” Powershell cmdlet, as shown in Figure 34.

The Grabber module configuration contains the path specified by an attacker to grab certain files/folders from. “FoF” parameter is likely the marker for whether the file folder grabber is specified (Figure 35).

Aurora Stealer stores its build configuration at the end of the binary in the base64-encoded format (Figure 36). However, the configuration will likely be stripped if the stealer is encrypted.

We wrote the configuration extractor script in Python for Aurora Stealer that looks for base64-encoded patterns within the binary.

The function main_ConnectToServer attempts to connect to the C2 server while printing the log messages, it sleeps after attempting to reconnect for one second and retries if the connection is unsuccessful (Figure 37).

If the connection is successful, the function exits with code “666” and log message “BLACK ZONE”.

main_PathTrans function is responsible for replacing the strings such as ^user^, ^document^, and ^desktop^ within the Grabber configuration with the paths of Desktop, Document, and %userprofile% (Figure 38).

March 2023 Update

In March 2023, the stealer developer released the first update since October 2022, as shown in Figure 39.

One of the major changes is the stealer’s capabilities to grab FTP (FileZilla) and RDP credentials as well as the ability to change the ports to the stealer’s panel and C2 communications and specify extensions, disk drives for the grabber module (Figure 40-41).

Besides the WMIC commands mentioned at the beginning of this report, the stealer developer added two new commands to run upon the execution of the malware:

• cmd.exe /c "wmic csproduct get uuid": the command retrieves the universally unique identifier (UUID) of the computer's system product
• systeminfo: The command is used to display detailed information about the operating system, hardware, and software components of a Windows computer system

Upon the execution of the stealer, PowerShell processes are spawned to copy the browsing data such as cookies, history, and credentials to AppData\Local\Temp directory under a randomly named folder, the example command:

• powershell "" "copy \"C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\Login Data\" \"C:\Users\<username>\AppData\Local\Temp\<random_folder>\""

C2 Communication & Stealer Logs

Aurora Stealer uses port 8081 for default communication with the C2 server, so prior to the stealer installation on the attacker’s server, it’s required to enable port 8081 through the firewall for the incoming traffic (Figure 42).

The stealer logs are sent to the C2 server in JSON format, GZIP-compressed and base64-encoded. The stealer logs are stored in the Aurora build folder in the format [Country]HWID_BuildID (Figure 43-44).

The cache folder contains the database files extracted from the infected host with cookies and credentials in the encrypted format as well as debug logs (Figure 45).

The stealer can also be configured to send stealer logs via Telegram where CDD is the “Cookies Detected” and PDD is the “Passwords detected”.

The attacker(s) can also configure to receive the stealer logs via Telegram (Figure 46).

How eSentire is Responding

Our Threat Response Unit (TRU) combines threat intelligence gained from research and security incidents to create practical outcomes for our customers. We are taking a comprehensive response approach to combat modern cybersecurity threats by deploying countermeasures, such as:

• Performing global threat hunts for indicators associated with Aurora Stealer.

• Implementing threat detections to identify malicious command execution and ensure that eSentire has visibility and detections are in place across eSentire MDR for Endpoint.

Our detection content is supported by investigation runbooks, ensuring our SOC (Security Operations Center) analysts respond rapidly to any intrusion attempts related to known malware Tactics, Techniques, and Procedures. In addition, TRU closely monitors the threat landscape, constantly addresses capability gaps, and conducts retroactive threat hunts to assess customer impact.

Recommendations from eSentire's Threat Response Unit (TRU)

We recommend implementing the following controls to help secure your organization against Aurora Stealer malware:

• Confirm that all devices are protected with Endpoint Detection and Response (EDR) solutions

• Implement a Phishing and Security Awareness Training (PSAT) Program that educates and informs your employees on emerging threats in the threat landscape.
• Encourage your employees to use password managers instead of using the password storage feature provided by web browsers. Use master passwords where it’s applicable.

While the TTPs used by threat actor(s) grow in sophistication, they lead to a certain level of difficulties at which critical business decisions must be made. Preventing the various attack technique and tactics utilized by the modern threat actor requires actively monitoring the threat landscape, developing and deploying endpoint detections, and the ability to investigate logs & network data during active intrusions.

eSentire’s TRU is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Yara rule

rule  AuroraStealer {
    meta:
        author = "eSentire Threat Intelligence"
        description = "Detects the Build/Group IDs if present / detects an unobfuscated AuroraStealer binary; tested on version 22.12.2022 and March 2023 update" 
        date = "3/24/2023"

    strings:
        $b1 = { 48 8D 0D ?? ?? 04 00 E8 ?? ?? EF FF }
        $b2 = { 48 8D 0D ?? ?? 05 00 E8 ?? ?? EF FF }
        $ftp = "FOUND FTP"
        $go = "Go build ID"
        $machineid = "MachineGuid"

    condition:
        3 of them
}

MITRE ATT&CK

Indicators of Compromise

Appendix

• https://www.esentire.com/security-advisories/increased-activity-in-google-ads-distributing-information-stealers
• https://twitter.com/1ZRR4H/status/1618136958596960256?s=20&t=UWEJ4jIxIg4XXv384Ibwow
• https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#14
• https://learn.microsoft.com/en-us/windows/win32/api/dpapi/nf-dpapi-cryptprotectdata
• https://learn.microsoft.com/en-us/windows/win32/api/dpapi/nf-dpapi-cryptunprotectdata
• https://unit42.paloaltonetworks.com/credential-gathering-third-party-software/
• https://github.com/RussianPanda95/Configuration_extractors/blob/main/aurora_config_extractor.py