{ "family": "stealc", "sample_count": 45, "category": "infostealer", "description": "Stealc is a lightweight, fully featured information stealer written in C that emerged in January 2023 on Russian-language cybercrime forums, rapidly gaining adoption as an affordable and potent alternative to Vidar and Raccoon Stealer. Created by a developer known as 'Plymouth', Stealc was explicitly modeled on the functional architectures of Vidar, Raccoon, and Mars Stealer, refining their modular downloading approach. Stealc relies on a small initial stub (often less than 80 KB) that performs comprehensive anti-analysis checks, verifying that the infected system is not running in an analysis sandbox, emulator, or CIS (Commonwealth of Independent States) locale. Once environment validation succeeds, the stub contacts its centralized command-and-control server via HTTP POST to retrieve dynamic extraction rules and legitimate third-party dynamic link libraries (such as sqlite3.dll, freebl3.dll, and nss3.dll) required to parse browser SQLite databases in memory without tripping endpoint detection. Stealc harvests credentials, autofill data, credit cards, and browsing history from over 75 web browsers, sweeps for 25+ desktop cryptocurrency wallets and 75+ browser Web3 wallet extensions, and exfiltrates session tokens from Discord, Telegram, and Outlook. Distributed through YouTube tutorials promoting software cracks, SEO-poisoned search results, and phishing archives exploiting CVE-2023-38831, Stealc finishes its routine by uploading an encrypted ZIP archive of stolen logs to the C2 and self-terminating via a command-line script that securely deletes the implant binary from disk.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "Stealc", "Stealc Stealer", "Trojan:Win32/Stealc", "Win32/Stealc", "Trojan.Stealc" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is Stealc malware and who created it?", "acceptedAnswer": { "@type": "Answer", "text": "Stealc is a lightweight information stealer developed in C by an actor known as 'Plymouth' in January 2023. It borrows architectural design concepts from Vidar, Mars, and Raccoon stealer families." } }, { "@type": "Question", "name": "How does Stealc download its dependencies dynamically?", "acceptedAnswer": { "@type": "Answer", "text": "Stealc keeps its initial binary small by dynamically requesting necessary browser-parsing libraries (sqlite3.dll, nss3.dll) directly from its C2 server after verifying the infected machine is a valid victim." } }, { "@type": "Question", "name": "What applications and assets does Stealc target?", "acceptedAnswer": { "@type": "Answer", "text": "Stealc targets over 75 browsers (passwords, autofill, credit cards), 25+ desktop cryptocurrency wallets, 75+ browser Web3 extensions, and desktop messaging clients (Telegram, Discord)." } }, { "@type": "Question", "name": "How is Stealc distributed to victims?", "acceptedAnswer": { "@type": "Answer", "text": "Stealc is commonly distributed via YouTube descriptions promoting cracked software or gaming cheats, SEO-poisoned download websites, and weaponized archives exploiting WinRAR vulnerability CVE-2023-38831." } }, { "@type": "Question", "name": "How does Stealc self-delete after exfiltrating data?", "acceptedAnswer": { "@type": "Answer", "text": "Upon successfully uploading the victim's stolen data archive to the C2 server, Stealc executes a temporary batch script or PowerShell command that repeatedly attempts to delete the executable binary from disk before deleting itself." } }, { "@type": "Question", "name": "How can defenders detect Stealc activity on endpoints?", "acceptedAnswer": { "@type": "Answer", "text": "Look for anomalous HTTP POST requests to unknown IP addresses ending in specific URI paths, monitor file creation of temporary sqlite3.dll files in %PROGRAMDATA% or %TEMP%, and deploy behavioral rules detecting browser credential database access by unverified binaries." } }, { "@type": "Question", "name": "What architectural features make Stealc's C-based lightweight footprint more evasive than legacy .NET stealers?", "acceptedAnswer": { "@type": "Answer", "text": "Stealc was coded from scratch in C/C++ to eliminate reliance on external runtimes such as .NET Framework or Python environments. This produces an exceptionally compact binary (often under 80 KB uncompressed) with minimal static footprints. Stealc dynamically imports API functions via API hashing, avoiding static IAT artifacts and allowing it to slip past traditional signature and heuristic scanners." } }, { "@type": "Question", "name": "How does Stealc dynamically configure file extraction paths via regex commands delivered by its C2 server?", "acceptedAnswer": { "@type": "Answer", "text": "Upon establishing its initial handshake with the C2 panel, Stealc requests an active grabber configuration. The C2 server responds with a dynamic JSON or delimited list of targeted file extensions, directory paths, and regular expression patterns (e.g., matching seed phrases or API tokens). Stealc parses this response in memory and performs targeted file searches, uploading matched documents to the C2 in a single multi-part HTTP request." } } ], "faq_count": 8, "mitre_attack": [ "T1555.003", "T1539", "T1005", "T1082", "T1083", "T1071.001", "T1105", "T1027", "T1497.001" ], "cisa_advisory": null, "exploited_cves": [ "CVE-2023-38831" ], "last_updated": "2026-10-16", "sources": [ { "name": "Group-IB Threat Intelligence: Stealc - A New Information Stealer on Underground Forums", "url": "https://www.group-ib.com/blog/stealc-infostealer/" }, { "name": "BleepingComputer: New Stealc Information Stealer Emerges on the Dark Web", "url": "https://www.bleepingcomputer.com/news/security/new-stealc-malware-emerges-with-data-stealing-capabilities/" }, { "name": "Cyfirma Research: Stealc Malware Deep Dive and Campaign Tracking", "url": "https://www.cyfirma.com/research/stealc-malware-deep-dive/" }, { "name": "SecurityWeek: Stealc Stealer Joins Ranks of Dominant Crimeware", "url": "https://www.securityweek.com/stealc-infostealer-emerges-cybercrime-forums/" } ], "iocs": { "file_hashes": [ "098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a", "671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b", "8ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a5202" ], "delivery": [ "YouTube video descriptions with links to mediafire or mega hosting cracked software and video games", "Search engine optimization (SEO) poisoning leading to fake freeware download portals", "Phishing archives weaponized with exploits for WinRAR CVE-2023-38831" ], "persistence": [ "Ephemeral single-execution model: executes in %TEMP%, steals data, exfiltrates, and securely self-deletes", "Batch script self-deletion loop executed via cmd.exe /c timeout /t 5 & del /f /q", "Registry Run keys employed only in customized threat-actor deployments" ] }, "lineage": { "derived_from": [ "vidar", "mars_stealer", "raccoon" ], "variants": [ "stealc_v1", "stealc_v2" ] }, "ecosystem": [ "windows", "windows_pe" ], "attack_stage": [ "initial_access", "execution", "credential_access", "discovery", "collection", "command_and_control", "exfiltration" ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }