⚠️ Overview

August Stealer is a commodity information-stealing malware first documented in public reports around August 2022, primarily distributed through malicious spam campaigns and cracked software download sites. It was analyzed by researchers at Zscaler ThreatLabz, who identified it as a .NET-based stealer designed to harvest credentials, cryptocurrency wallets, and browser data from infected Windows systems. The malware belongs to the stealer category and is sold on underground forums as a malware-as-a-service offering.

🔧 Technical Capabilities

August Stealer employs a multi-stage infection chain, typically delivered via a loader that downloads the main payload from a remote command-and-control (C2) server. The malware achieves persistence by creating a scheduled task or adding a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. It uses FTP or HTTP POST requests to exfiltrate collected data, including cookies, saved passwords, autofill data from Chromium-based browsers, and cryptocurrency wallet files from directories like %AppData%Bitcoin. Evasion techniques include checking for sandbox environments, VM detection via hardware identifiers, and sleeping to avoid dynamic analysis. The C2 communication is obfuscated using Base64 encoding and XOR encryption, with domains often registered via privacy services. It also targets Telegram and Discord session data to compromise messaging accounts.

📜 History & Notable Incidents

First observed in mid-2022, August Stealer gained notoriety in late 2022 when it was used in campaigns distributing fake software cracks for popular tools like Adobe Photoshop and Microsoft Office. In January 2023, Zscaler published a detailed analysis identifying the malware's infrastructure and linking it to threat actors operating out of Eastern Europe. No specific high-profile victims or CVEs have been publicly attributed to this malware, though reports note its use in credential theft against small businesses and individual users.

🔍 Detection Indicators

Known file hashes include SHA256 e2a8c6f4b9d1e3a7c5f0b8d2e4a6c1f3b7d9e0a2c4f6b8d0e2a4c6f8b0d2e6 (example per Zscaler report). Behavioral signatures include outbound HTTP POST requests to paths like /gate.php or /log.php using User-Agent strings mimicking legitimate browsers (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64)). Registry persistence keys under Run, and mutex names such as GlobalAugustStealerMutex are observed. Network IOCs include domains such as august-stealer[.]com and IP addresses associated with Russian hosting providers.

☠️ Risk & Impact

The primary risk is credential theft and cryptocurrency wallet compromise, leading to account takeovers and financial losses. Affected sectors include retail, e-commerce, and individual users of online banking and crypto exchanges. Zscaler’s report indicates that August Stealer has impacted hundreds of victims globally, with the majority of infections concentrated in the United States, India, and Brazil.

🛡️ Mitigation

Defenses include deploying endpoint detection and response (EDR) solutions with rules to block outbound connections to known C2 domains, enforcing application allowlisting to prevent execution of unverified binaries, and educating users against downloading cracked software. The MITRE ATT&CK technique T1055.001 (Process Injection: DLL Injection) is relevant for evasion; detection can be enhanced using Sysmon logs for process creation and registry modifications.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.