{
  "family": "usteal",
  "sample_count": 28,
  "category": "infostealer",
  "description": "USteal (cataloged across security intelligence feeds under signatures including Trojan-PSW.Win32.USteal, PWS:Win32/USteal, and Trojan.USteal) is a specialized password-stealing utility and credential harvesting trojan active since 2012. Engineered with a lightweight, standalone footprint, USteal is frequently deployed via autorun-enabled USB flash drives or dropped by initial access stagers. Upon execution on a victim Windows system, USteal immediately harvests saved authentication credentials, web browser history, cookies, and autofill vaults from major browsers (Google Chrome, Mozilla Firefox, Opera, Internet Explorer). In addition, it extracts stored credentials from email clients (Outlook, Thunderbird) and FTP applications (FileZilla). Harvested credentials and system metadata are consolidated into text or sqlite report files and covertly copied to connected removable storage media or exfiltrated via HTTP POST requests.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-PSW.Win32.USteal",
    "PWS:Win32/USteal",
    "Trojan:Win32/USteal",
    "Win32/USteal",
    "Trojan.USteal"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-PSW.Win32.USteal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "USteal is a lightweight password stealer designed to extract browser logins, email credentials, and FTP passwords onto USB drives or remote drop servers."
      }
    },
    {
      "@type": "Question",
      "name": "How does USteal spread via USB drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It leverages autorun scripts or deceptive folder icons on removable flash drives to execute automatically when plugged into victim computers."
      }
    },
    {
      "@type": "Question",
      "name": "Which software applications are targeted by USteal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "USteal targets web browsers (Chrome, Firefox, Opera), email clients (Outlook, Thunderbird), and FTP tools (FileZilla)."
      }
    },
    {
      "@type": "Question",
      "name": "How does USteal exfiltrate harvested passwords?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes harvested credentials to hidden logs on connected USB drives or transmits them via HTTP POST requests to remote servers."
      }
    },
    {
      "@type": "Question",
      "name": "What actions are necessary after a USteal infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately change all passwords accessed from the machine, invalidate active web session cookies, and enable Multi-Factor Authentication."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.003",
    "T1555.004",
    "T1052.001",
    "T1041",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Infected Removable USB Drives",
    "Secondary Dropper Payloads",
    "Phishing Email Attachments"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Browser Stored Password & Cookie Theft",
    "Email Client & FTP Credential Extraction",
    "USB Removable Storage Harvesting",
    "Encrypted HTTP POST Exfiltration",
    "Rapid Execution & Self-Deletion"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C/C++)",
      "Report Text File (.log / .txt)"
    ],
    "network_signatures": [
      "Outbound HTTP POST requests transmitting base64-encoded credential strings to remote web drop points",
      "Direct writing of credential reports to USB drive root directories"
    ],
    "evasion_techniques": [
      "Operating without creating persistent registry keys or background services to reduce forensic visibility",
      "Self-deletion using a temporary batch file upon completing exfiltration"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7af0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8",
      "8ba1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9"
    ],
    "registry_keys": [],
    "file_paths": [
      "%Temp%\\usteal.exe",
      "%LocalAppdata%\\Temp\\passwords.log"
    ]
  },
  "defensive_measures": [
    "Disable USB AutoPlay and AutoRun across all corporate workstations via Group Policy",
    "Enforce Multi-Factor Authentication (MFA) across enterprise accounts to mitigate the impact of stolen passwords",
    "Deploy endpoint security that monitors processes accessing browser user data and DPAPI secrets"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan-PSW:Win32/USteal",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-PSW:Win32/USteal"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan-PSW.Win32.USteal",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan-PSW:Win32/USteal.A",
      "PWS:Win32/USteal.B"
    ]
  },
  "motivation": "Credential Theft, Identity Hijacking & Account Compromise",
  "sample_hashes": []
}