Open C2 Panel Reveals Auraboros RAT Audio Streaming and Keylogging Features

Cybersecurity researchers have uncovered a previously undocumented command-and-control framework dubbed Auraboros C2.

Uniquely, the panel’s management dashboard, victim lists, and command APIs are exposed entirely without authentication. Serving over plain HTTP with a wide-open Cross-Origin Resource Sharing (CORS) policy, the platform allows complete visibility into its backend operations.

The 84KB JavaScript source code reveals a sophisticated remote access trojan capable of live audio streaming, webcam capture, keystroke logging, and advanced browser data theft.

Despite featuring a highly polished user interface in Brazilian Portuguese that bears the copyright of “Auraboros Advanced Defense Systems,” the developer made critical operational security mistakes.

By leaving their own testing environment and command history publicly accessible, the author inadvertently provided threat intelligence researchers with a comprehensive blueprint of the malware’s capabilities and internal architecture.

Advanced Features and Sideloading Architecture

The Auraboros implant masquerades as a legitimate Windows system utility named DiskIntegrityScanner.exe. Rather than functioning as a standalone executable, it leverages a common defense evasion technique known as DLL sideloading.

The clean binary loads a malicious payload into memory, which then heavily fingerprints the compromised machine to extract hardware specifications, user privilege levels, and precise geolocation data.

Once the agent is registered with the server, it establishes real-time communication via the Socket.io transport.

This persistent connection enables operators to execute rapid surveillance commands, including taking stealthy screenshots and initiating continuous live audio streaming directly from the victim’s microphone.

In addition to its surveillance capabilities, the malware includes an extensive data-stealing module that targets credentials in modern web browsers such as Chrome and Brave.

It abuses the native Windows Data Protection API (DPAPI) to decrypt master keys, enabling the malware to extract saved passwords and session cookies quietly. Furthermore, Auraboros boasts a sophisticated cookie impersonation engine.

By chaining stolen browser sessions with a built-in reverse SOCKS5 proxy, an attacker can hijack web sessions while routing malicious traffic through the victim’s own IP address.

This advanced technique significantly complicates network detection efforts.

For situations where the operator wishes to remain undetected after an operation, the developer even included an over-the-air update module and a self-destruct mechanism to remove the malware from the disk completely.

Despite the technically advanced features embedded within the implant, the overarching framework suffers from glaring, amateur operational security flaws.

The breakglass complete absence of basic authentication means that any internet scanner hitting port 5000 can view the main dashboard, extract stolen browser data, and monitor the live keylogger feed in real time.

Furthermore, the real-time Socket.io configuration broadcasts command results to all connected clients without any session isolation or access controls.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Open C2 Panel Reveals Auraboros RAT Audio Streaming and Keylogging Features appeared first on Cyber Security News.