What Does the Stealc Stealer Report Cover?
The Stealc stealer is a malware-as-a-service information stealer for Windows that takes browser credentials, cookies, cryptocurrency wallet data and files. INCIBE and India’s CSK say it spreads through phishing emails, fake software and compromised websites. This report covers its technical method of operation, infection methods, detections, IoCs and mitigation.
For context, Microsoft says Amadey is a malware-as-a-service loader that threat actors use to deliver Stealc and other malware.
Learn Technical Method of Operation Details
The technical details of the Stealc and its abilities, infection methods, and more. The report will show many points about the malware’s technical details, detections, and IoCs.
Gain Knowledge About Future Attacks
By understanding its attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. The malware has been increasingly active and sophisticated in recent years, making it more difficult for companies to protect themselves.
What Is Inside the Stealc Technical Analysis Report?
The report is 18 pages long. It is report number BD20230303 and is marked TLP:CLEAR. It has four chapters: Overview, Technical Analysis, YARA Rules and Conclusion.
Which Sample Did the Report Analyze?
The Overview lists one sample, a file named hbmix.file, with its MD5, SHA-1 and SHA256 hashes. The report says the sample is packed with pkr_ce1a, a malicious packer. It says Stealc also uses string obfuscation and checks for analysis tools.
What Technical Findings Does the Report State?
- Execution flow: the sample runs a first stage shellcode in memory. That shellcode decodes the Stealc payload. A second stage shellcode then runs anti-virtualization and analysis checks. If the checks pass, the malware contacts its command and control server. If not, it stops.
- String obfuscation: the report says strings are hidden with Base64 and RC4.
- Command and control: the target list and settings arrive from the server in Base64 form. Stolen data goes back in an HTTP POST request, also Base64 encoded.
- Extra files: the malware downloads 7 legitimate third-party DLLs from the server, including sqlite3.dll and nss3.dll.
What Does Stealc Go After?
The report gives tables of targets. They cover web browsers and their data paths, browser extensions with their extension IDs, and desktop cryptocurrency wallets with their file paths. The extension list includes password managers and authenticator extensions as well as wallets. The report notes that the target list comes from the server, so it can differ between builds.
How Can Teams Detect and Defend Against It?
Chapter 3 gives two YARA rules. One matches the packed sample and one matches the unpacked payload. The conclusion calls for regular updates, network monitoring and employee awareness training. It also stresses collaboration and information sharing.
Who Is This Report for?
It suits malware analysts, detection engineers and incident responders. They can use the hashes, the target tables and the YARA rules in their own checks. Security managers can use the conclusion to see the business impact the report names: financial loss, identity theft and reputational damage.