Full Report
Aurastealer, ACRStealer, and RemusStealer, a new potential LumaStealer variant, show MaaS in action. Here's what you need to know.
Analysis Summary
# Tool/Technique: AuraStealer, ACRStealer, and RemusStealer (Infostealer MaaS)
## Overview
These tools represent the modern Malware-as-a-Service (MaaS) ecosystem, focusing on the exfiltration of sensitive data. They are designed to lower the barrier of entry for cybercriminals by providing easy-to-use, subscription-based interfaces for harvesting credentials, financial data, and session tokens.
## Technical Details
- **Type:** Malware Family (Infostealers)
- **Platform:** Windows (Primary target for described samples)
- **Capabilities:** Credential harvesting, crypto-wallet theft, session token extraction, anti-analysis, and evasion.
- **First Seen:** Samples described were highly active between July and August 2026.
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1055 - Process Injection]
- [T1056.004 - Process Hollowing]
- [T1497 - Virtualization/Sandbox Evasion]
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Password Stores]
- [T1539 - Steal Web Session Cookie]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
* **AuraStealer:** Actively maintained with a focus on stealing browser data and sensitive files.
* **ACRStealer:** A persistent family designed to extract credentials and system information.
* **RemusStealer:** A potential variant of **LummaStealer**, specializing in rapid data exfiltration.
* **Data Harvesting:** Targets include browser cookies, stored passwords, cryptocurrency wallets, and clipboard data.
### Advanced Features
* **Anti-Analysis:** AuraStealer includes updated features to detect debuggers and virtual environments.
* **Stealth Tactics:** Use of process hollowing and injection to hide malicious code inside legitimate, trusted system processes.
* **MaaS Infrastructure:** Provided via dashboards for attackers to track "logs" (stolen data) without needing to manage back-end infrastructure.
## Indicators of Compromise
### File Hashes (SHA256)
* `b40cb47ab1775a4be4ec9b997b58bedfeb2076079df0804dc80982c0309fa9a2`
* `c1e0d2c9e04fcdb10ff2d4565758ceda1331fc80def548742a79b60be81da9b9`
* `d3b08fd3ce1ca451b1dffd00c657b6ac1ad8ad769171faa1ba9688b572283d32`
* `cd7c5860e0e6bdbc49ae5f07d85989469a41a108dede6f6086541d276ccc155f`
* `e99d9294331c15c7ee0f4a03f8b95eda42fa065ec7d008bc326f9d8db562c118`
* `f68ba32766e087f5a6855fa7da9feea2968280a019aec31d7d173adcd4b848ca`
### Network Indicators
* Communication often involves encrypted traffic to varied C2 endpoints (Defanged: `example-c2[.]com`).
### Behavioral Indicators
* Injection into `explorer.exe` or `svchost.exe`.
* Unexpected modifications to browser profile folders.
* Rapid outbound HTTPS connections following the execution of suspicious attachments/downloads.
## Associated Threat Actors
* Operated by various unnamed cybercriminal affiliates leveraging MaaS platforms.
* Commonly distributed through **ClickFix** campaigns, which trick users into executing malicious code via fake browser updates or "fix" instructions.
## Detection Methods
* **Signature-based:** Monitoring for known file hashes (listed above).
* **Behavioral detection:** Flagging process hollowing attempts and unauthorized access to credential storage files (e.g., `Login Data` in Chrome).
* **Network Monitoring:** Identifying traffic to known MaaS infrastructure and high volumes of data exfiltration.
## Mitigation Strategies
* **Disable Unnecessary Scripts:** Block execution of suspicious scripts in common user folders.
* **Endpoint Protection:** Deploy EDR solutions capable of detecting process injection and hollowing.
* **User Education:** Train users to recognize "ClickFix" social engineering tactics, such as copy-pasting code into PowerShell.
* **Multi-Factor Authentication (MFA):** Implement hardware-based or non-SMS MFA to reduce the impact of stolen session tokens and passwords.
## Related Tools/Techniques
* **LummaStealer:** The progenitor/related family to RemusStealer.
* **ClickFix:** A prevalent delivery technique used to distribute these stealers.
* **Redline/Vidar:** Similar infostealer families operating in the MaaS space.