Stealc Infostealer Malware

Researchers have detailed out about the information-stealing malware that is rapidly growing in popularity on dark web marketplaces, called Stealc.

The malware was first spotted being offered on a forum by a user named Plymouth. Stealc was advertised as a fully featured and ready-to-use stealer and has similarities with other info stealer malware such as Vidar, Raccoon, Mars, and Redline.

Stealc targets sensitive data from web browsers, extensions for cryptocurrency wallets, desktop cryptocurrency wallets, and information from additional applications, including email clients and messenger software. The data collection configuration can be customized to meet the needs.

The malware implements a customizable file grabber, to steal files matching their grabber rules. The stealer was also found to have loader capabilities that are typical for an information stealer sold as malware-as-a-service.

Currently, it’s being sold on a Malware-as-a-service and customers own a build of its administration panel to host the stealer command-and-control center, the build will likely leak to underground communities in the medium term. Eventually, a cracked version of a Stealc build may be released, which could be used for many years to come.

It’s expected that the Stealc info stealer will become widespread in the near term, as multiple threat actors add the malware to their arsenal while it is poorly monitored. Companies facing targeted stealer attacks are warned to be aware of this malware.

This research was documented by researchers from Sekoia