Price: 295-585$
Buy in Telegram: @aura_corp (Aura Seller)
AURA Stealer is a carefully calibrated solution where every detail exists not for beauty, but for results.
It collects data from over 110 browsers, 70 applications, including wallets and 2FA, and over 250 browser extensions. That's not all: you can add any application or extension to the collection configuration at any time with just a couple of clicks.
We collect cookies from open Chromium browsers without killing the process (we don't delete cookies). Our own shellcode for decrypting App-Bound. All decryption is server-side - the build performs a minimum of suspicious actions.
There is a loader. The build weighs ~500-700 Kb and is reinforced with a morpher developed from scratch. This and much more awaits you with AURA!
Build:
- The build is written in C++ (NtAPI/WinAPI + CRT/STL). The build size is ~500-700 Kb (varies in each build after morphing) and is compressed to 170-250 Kb by packers.
- Static link, runs on the entire Win7 - Win11 line. No dependencies, works on clean systems.
- Parts of the code that are critical for speed or stealth are built on NtAPI, less demanding parts are built on WinAPI.
- Imports are hidden, functions are obtained dynamically and cached in an encrypted hash table. Function addresses are not stored in plain text and are decrypted immediately before being called. The build contains only CRT imports and fake imports (which change when recompiled).
- Strings are encrypted and decrypted at runtime.
- Protection against double launch (dynamic mutex based on the DGA principle).
- Customizable Sleep before launch.
- AntiVM/Sandbox. Standard virtual/emulated environment checks. Can be enabled or disabled in the panel.
- AntiDebug. Nasty anti-debugging methods tightly integrated with our technologies. They will make even seasoned reverse engineers spit at their monitors. Anti-debugging cannot be disabled in the panel.
- ApiHammering. Background noise to simulate legitimate activity and randomize behavior at runtime. Random WinAPI calls and file system interactions (creating, writing, reading files) that are irrelevant to the task are scattered throughout the code.
- A powerful grabber with flexible collection customization. The panel allows you to set the initial collection path, search masks, recursion level, file size limit, folder in the archive, and other parameters depending on the type of collection.
- Very fast and compact Wildcard engine for searching files by masks from the config. While others offer only file extension searches, we allow you to build more complex rules with different levels of nesting (e.g., folder/folder*abc*def/.txt). It also supports relative paths with an exit from the initial directory to the level above (e.g., ../folder/*.txt), which is useful for collection by process name when the initial collection folder is unknown.
- The grabber has built-in protection against duplicate collection - the paths of scanned files are cached in a hash table. If the configuration is set up incorrectly, you will not receive a log with duplicate files.
- When the grabber is running, nothing is dropped to disk; archives are assembled in RAM. The log is transmitted to the server in parts, so even if the build catches a runtime detection, part of the data will already be on the server and you will not lose the entire log.
- All traffic between the build and C2 is encrypted with AES-256 and goes through the HTTPS protocol (its own wrapper over WinHTTP).
- In case of connection loss, the build cyclically waits for an internet connection, after which it continues from where it left off. In case of routing problems, it selects a random working one and continues sending.
- Protection against unencrypted file leakage. If the build is launched without encryption, a captcha window will appear. After entering the captcha, the build will run in normal mode. After crypt/packaging, the captcha does not appear.
- The build does not knock in CIS countries (CIS / former USSR)! Checking the layout and language of the system + checking the IP on the server.
Pricing:
Basic ($295/month).
Your path to success starts here!
- Keyword search
- Search by country
- Search by date and time
- Ability to add 2 bulk uploads to the queue
- Ability to customize browser extension collection
- Add 2 graber configurations in addition to the standard one
- Ability to link 3 tags to a build
- Ability to create 2 builds (configuration template)
- Link one Telegram bot
Advanced ($585/month).
The golden mean for those who are used to winning!
- Advanced log filtering
- Ability to search by build
- Buttons for quick date selection by filter (24h, 7d, 30d)
- Search by tags
- Search by applications
- Search by wallets
- Search by IP address and ranges
- Additional options (hide empty, hide duplicates, hide downloaded)
- Mass upload limit increased to 4
- Ability to create up to 5 links for workers
- You can add 5 additional configurations in addition to the standard one
- Ability to attach up to 8 tags to each build
- Addition of a list of user agents in the build (used for tapping)
- Disabling the acceptance of new loots on a specific build
- Ability to create up to 5 builds (configuration templates)
- Ability to link up to 5 Telegram bots
Buy in Telegram: @aura_corp (Aura Seller)
Buy in Telegram: @aura_corp (Aura Seller)
AURA Stealer is a carefully calibrated solution where every detail exists not for beauty, but for results.
It collects data from over 110 browsers, 70 applications, including wallets and 2FA, and over 250 browser extensions. That's not all: you can add any application or extension to the collection configuration at any time with just a couple of clicks.
We collect cookies from open Chromium browsers without killing the process (we don't delete cookies). Our own shellcode for decrypting App-Bound. All decryption is server-side - the build performs a minimum of suspicious actions.
There is a loader. The build weighs ~500-700 Kb and is reinforced with a morpher developed from scratch. This and much more awaits you with AURA!
Build:
- The build is written in C++ (NtAPI/WinAPI + CRT/STL). The build size is ~500-700 Kb (varies in each build after morphing) and is compressed to 170-250 Kb by packers.
- Static link, runs on the entire Win7 - Win11 line. No dependencies, works on clean systems.
- Parts of the code that are critical for speed or stealth are built on NtAPI, less demanding parts are built on WinAPI.
- Imports are hidden, functions are obtained dynamically and cached in an encrypted hash table. Function addresses are not stored in plain text and are decrypted immediately before being called. The build contains only CRT imports and fake imports (which change when recompiled).
- Strings are encrypted and decrypted at runtime.
- Protection against double launch (dynamic mutex based on the DGA principle).
- Customizable Sleep before launch.
- AntiVM/Sandbox. Standard virtual/emulated environment checks. Can be enabled or disabled in the panel.
- AntiDebug. Nasty anti-debugging methods tightly integrated with our technologies. They will make even seasoned reverse engineers spit at their monitors. Anti-debugging cannot be disabled in the panel.
- ApiHammering. Background noise to simulate legitimate activity and randomize behavior at runtime. Random WinAPI calls and file system interactions (creating, writing, reading files) that are irrelevant to the task are scattered throughout the code.
- A powerful grabber with flexible collection customization. The panel allows you to set the initial collection path, search masks, recursion level, file size limit, folder in the archive, and other parameters depending on the type of collection.
- Very fast and compact Wildcard engine for searching files by masks from the config. While others offer only file extension searches, we allow you to build more complex rules with different levels of nesting (e.g., folder/folder*abc*def/.txt). It also supports relative paths with an exit from the initial directory to the level above (e.g., ../folder/*.txt), which is useful for collection by process name when the initial collection folder is unknown.
- The grabber has built-in protection against duplicate collection - the paths of scanned files are cached in a hash table. If the configuration is set up incorrectly, you will not receive a log with duplicate files.
- When the grabber is running, nothing is dropped to disk; archives are assembled in RAM. The log is transmitted to the server in parts, so even if the build catches a runtime detection, part of the data will already be on the server and you will not lose the entire log.
- All traffic between the build and C2 is encrypted with AES-256 and goes through the HTTPS protocol (its own wrapper over WinHTTP).
- In case of connection loss, the build cyclically waits for an internet connection, after which it continues from where it left off. In case of routing problems, it selects a random working one and continues sending.
- Protection against unencrypted file leakage. If the build is launched without encryption, a captcha window will appear. After entering the captcha, the build will run in normal mode. After crypt/packaging, the captcha does not appear.
- The build does not knock in CIS countries (CIS / former USSR)! Checking the layout and language of the system + checking the IP on the server.
Pricing:
Basic ($295/month).
Your path to success starts here!
- Keyword search
- Search by country
- Search by date and time
- Ability to add 2 bulk uploads to the queue
- Ability to customize browser extension collection
- Add 2 graber configurations in addition to the standard one
- Ability to link 3 tags to a build
- Ability to create 2 builds (configuration template)
- Link one Telegram bot
Advanced ($585/month).
The golden mean for those who are used to winning!
- Advanced log filtering
- Ability to search by build
- Buttons for quick date selection by filter (24h, 7d, 30d)
- Search by tags
- Search by applications
- Search by wallets
- Search by IP address and ranges
- Additional options (hide empty, hide duplicates, hide downloaded)
- Mass upload limit increased to 4
- Ability to create up to 5 links for workers
- You can add 5 additional configurations in addition to the standard one
- Ability to attach up to 8 tags to each build
- Addition of a list of user agents in the build (used for tapping)
- Disabling the acceptance of new loots on a specific build
- Ability to create up to 5 builds (configuration templates)
- Ability to link up to 5 Telegram bots
Buy in Telegram: @aura_corp (Aura Seller)