Aurora Stealer: A Shapeshifting Malware Using Evolving Tactics

This report documents a phishing-driven campaign delivering Aurora Stealer — a Go-based information stealer that impersonates messenger and TeamViewer sites to trick users into downloading padded malicious binaries (examples: messenger.exe, teamviewer.exe). The analysis provides sample hashes, download URLs, the C2 45.15.156.210:8081, detailed collection/exfiltration behavior targeting browsers, crypto wallets and extensions, discovery and evasion techniques, a list of IOCs, and recommended mitigations.