StealC V2 is an advanced infostealer and malware downloader with enhanced stealth features, a JSON-based C2 protocol, and flexible payload delivery capabilities. It targets a broad range of victims worldwide while excluding systems in CIS countries, and employs hardware ID generation and multiple evasion techniques. #StealC #Plymouth #Themida
Keypoints
- StealC first appeared on dark web marketplaces in early 2023 and evolved into StealC V2 in March 2025, introducing improved stealth, a JSON-based command-and-control protocol, and a redesigned web control panel.
- The malware avoids infecting systems in CIS countries through a language check, indicating likely Eastern European origin of its developers.
- StealC V2 generates a unique hardware ID from the system’s volume serial number to identify infected hosts and manage infections uniquely.
- Communication with the C2 server uses Base64-encoded JSON messages over HTTP, including registration, data exfiltration, payload instructions, and optional self-deletion commands.
- The malware features a versatile loader module capable of executing executable files, PowerShell scripts, and MSI installers with retry and privilege escalation mechanisms.
- Its grabber module targets browsers, cryptocurrency wallets, email and VPN clients, instant messaging apps, and user files, with local decryption for Firefox and server-side decryption for Chromium-based browsers.
- Defenses recommended include strong user education, endpoint protection with behavioral detection, application allow-listing, multi-factor authentication, network monitoring, and threat hunting via YARA and memory analysis.
MITRE Techniques
- [T1056] Input Capture – StealC steals credentials from browsers, email clients, VPNs, and cryptocurrency wallets by extracting stored data and session information (“extract credentials and session data from web browsers and plugins”).
- [T1071] Standard Application Layer Protocol – Communicates with the C2 server using HTTP and Base64-encoded JSON (“StealC v2 communicates with its command-and-control (C2) server over HTTP, using Base64-encoded JSON messages”).
- [T1106] Execution through API – Uses ShellExecuteEx to run payload executables and self-deletion commands (“executed using ShellExecuteEx and ensures the binary is removed after execution”).
- [T1059.001] PowerShell – Executes PowerShell scripts in memory fetched from attacker-controlled URLs (“constructs and executes a command that fetches and runs a remote PowerShell script directly in memory”).
- [T1560] Archive Collected Data – Divides large files into 512 KB chunks for exfiltration (“StealC can divide files into 512 KB chunks and send them as multipart uploads”).
- [T1083] File and Directory Discovery – Recursively scans user directories based on CSIDL codes to locate target files (“search specific user directories using CSIDL codes… to find files”).
- [T1140] Deobfuscate/Decode Files or Information – Uses RC4 encryption to obfuscate strings in the binary (“strings in the malware are encrypted using RC4 with a hardcoded key”).
- [T1480] Execution Guardrails – Implements language and regional checks to avoid infecting CIS countries (“StealC’s code includes a language check to exclude computers set to languages of the CIS”).
- [T1027] Obfuscated Files or Information – Employs Themida packer and string encryption for stealth (“packed StealC v2 samples observed are often protected with Themida packer”).
- [T1074] Data Staged – Aggregates stolen data in staged chunks before exfiltration (“sends files in chunks with metadata for reassembly on server”).
Indicators of Compromise
- [File Hash] StealC V2 unpacked samples – SHA-256: 27c77167584ce803317eab2eb5db5963e9dfa86450237195f5723185361510dc, A1b2aecdd1b37e0c7836f5c254398250363ea74013700d9a812c98269752f385
- [File Hash] StealC V2 packed samples with Themida – SHA-256: 0b921636568ee3e1f8ce71ff9c931da5675089ba796b65a6b212440425d63c8c, e205646761f59f23d5c8a8483f8a03a313d3b435b302d3a37061840b5cc084c3
- [IP Address] Known C2 servers – 45.93.20[.]28, 88.214.48[.]93 (used for command and control communication)
- [File Name] Common sample executable names – StealC.exe and various customized names generated by the builder panel for campaign-specific binaries
Views: 48