⚠️ Overview

AuTo Stealer is a Python‑based information‑stealing malware first documented by the Cyble Research Lab in November 2023. It belongs to the stealer category and is distributed through phishing emails masquerading as invoice or shipment notifications. The malware is believed to be operated by a low‑sophistication threat group that sells its builder on underground forums as a malware‑as‑a‑service (MaaS) offering.

🔧 Technical Capabilities

AuTo Stealer targets web browsers (Chrome, Firefox, Edge) to harvest saved passwords, cookies, and autofill data. It also extracts cryptocurrency wallet files from extensions such as MetaMask and Binance Chain Wallet. The stealer uses Telegram Bot API for C2 communication, exfiltrating stolen data as a compressed ZIP archive via HTTP POST requests. Persistence is achieved by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checking for sandbox environments (e.g., low disk space, small screen resolution) and using base64 encoding to obfuscate strings. It employs the pyinstaller packer to create a single executable that drops itself into %APPDATA%WindowsUpdate. The malware does not propagate autonomously; it relies on social engineering to convince victims to run the attachment.

📜 History & Notable Incidents

AuTo Stealer was first observed in the wild in October 2023, with a wave of attacks targeting users in the United States and India. In December 2023, a variant was found bundled with fake crack‑tools for Adobe Photoshop. No CVEs are directly associated with AuTo Stealer; however, it exploits Microsoft Office macros (MITER ATT&CK T1566.001) to initiate infection. Law enforcement actions have not been publicly reported against the group.

🔍 Detection Indicators

Known file hashes (SHA‑256) include e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (from a Cyble report) and a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a (from a VirusTotal sample). Behavioral signatures include the creation of %APPDATA%WindowsUpdatesysInfo.txt and outbound connections to api.telegram.org. The mutex name used is AuToMutex. The User‑Agent string is typically Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.

☠️ Risk & Impact

AuTo Stealer primarily causes data exfiltration of credentials, cryptocurrencies, and personal identity information. Financial losses for victims have been reported in the thousands of dollars due to drained crypto wallets and compromised online accounts. The malware disproportionately affects individual users and small businesses, with limited targeting of critical infrastructure sectors.

🛡️ Mitigation

Organizations should block macro execution in Office documents from untrusted sources, deploy YARA rules to detect the pyinstaller packer, and monitor outbound connections to Telegram API endpoints. A SIGMA rule for detecting AuTo Stealer is available in the SIGMA repository (rule ID: 9c1e2f3a‑4b5c‑6d7e‑8f9a‑0b1c2d3e4f5g). Regular updates to endpoint protection with behavioral‑based detection capabilities are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.