SYMBOLCOMMON_NAMEaka. SYNONYMS
win.stealc (Back to overview)

Stealc

VTCollection    

Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.

Stealc is written in C and uses WinAPI functions. It mainly targets data from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.

References
2026-07-15 ⋅ Github (Yavuzhanzgen) ⋅ Yavuzhan Özgen
StealC V2 Malware Technical Analysis
Stealc
2026-06-24 ⋅ Europol ⋅ Europol
Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks
FAKEUPDATES Amadey Stealc
2026-06-24 ⋅ BitSight ⋅ Bitsight TRACE
Amadey and StealC: Malware-as-a-Service Unavailable
Amadey Stealc
2026-04-18 ⋅ Hexastrike Cybersecurity ⋅ Maurice Fielenbach
Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
SmartLoader Stealc
2026-03-27 ⋅ Max's Blog ⋅ Max Chertin
Analyzing StealC V2
Stealc
2026-02-12 ⋅ LevelBlue ⋅ Rodel Mendrez
How ClickFix Opens the Door to Stealthy StealC Information Stealer
IClickFix Stealc
2026-01-15 ⋅ CyberArk ⋅ Ari Novick
UNO reverse card: stealing cookies from cookie stealers
Stealc
2025-09-26 ⋅ ZAYOTEM ⋅ Yavuzhan Özgen
StealC V2 Malware Technical Analysis
Stealc
2025-05-21 ⋅ Trendmicro ⋅ Junestherry Dela Cruz
TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead
Stealc Vidar
2025-05-11 ⋅ Avia Barazani
Breaking Down A Multi-Stage PowerShell Infection
Stealc
2025-05-01 ⋅ Zscaler ⋅ ThreatLabZ research team
I StealC You: Tracking the Rapid Changes To StealC
Stealc
2025-04-29 ⋅ Recorded Future ⋅ Insikt Group
Uncovering MintsLoader With Recorded Future Malware Intelligence Hunting
FAKEUPDATES MintsLoader GhostWeaver Stealc TAG-124
2025-04-10 ⋅ Medium TRAC Labs ⋅ TRAC Labs
Autopsy of a Failed Stealer: StealC v2
Stealc
2025-03-28 ⋅ Trend Micro ⋅ Ahmed Mohamed Ibrahim, Aliakbar Zahravi
A Deep Dive into Water Gamayun’s Arsenal and Infrastructure
DarkWisp SilentPrism Kematian Stealer Rhadamanthys Stealc Water Gamayun
2025-03-04 ⋅ Hunt.io ⋅ Hunt.io
Exposing Russian EFF Impersonators: The Inside Story on Stealc & Pyramid C2
Pyramid Stealc
2025-01-16 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
MintsLoader: StealC and BOINC Delivery
MintsLoader Stealc
2025-01-10 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update July to December 2024
Coper FluBot Hook Mirai FAKEUPDATES AsyncRAT BianLian Brute Ratel C4 Cobalt Strike DanaBot DCRat Havoc Latrodectus NjRAT Quasar RAT RedLine Stealer Remcos Rhadamanthys Sliver Stealc
2024-10-17 ⋅ Sekoia ⋅ Quentin Bourgue, Sekoia TDR
ClickFix tactic: The Phantom Meet
Rhadamanthys Stealc
2024-10-03 ⋅ Lexfo ⋅ Lexfo
StealC Malware Analysis Part 3
Stealc
2024-10-03 ⋅ Lexfo ⋅ Lexfo
StealC Malware Analysis Part 1
Stealc
2024-10-03 ⋅ Lexfo ⋅ Lexfo
StealC Malware Analysis Part 2
Stealc
2024-08-15 ⋅ Kaspersky ⋅ AbdulRhman Alfaifi, Elsayed Elrefaei
Tusk campaign uses infostealers and clippers for financial gain
DanaBot HijackLoader Stealc
2024-06-17 ⋅ Recorded Future ⋅ Insikt Group
The Travels of “markopolo”: Self-Proclaimed Meeting Software Vortax Spreads Infostealers, Unveils Expansive Network of Malicious macOS Applications
AMOS Rhadamanthys Stealc Markopolo
2024-02-20 ⋅ YouTube (Embee Research) ⋅ Embee_research
StealC Loader Analysis - Decoding Powershell Malware With CyberChef
Stealc
2024-01-30 ⋅ ANY.RUN ⋅ Lena (LambdaMamba)
CrackedCantil: A Malware Symphony Breakdown - PrivateLoader, Smoke, Lumma, RedLine, RisePro, Amadey, Stealc, Socks5Systemz, STOP
Amadey CrackedCantil Lumma Stealer PrivateLoader RedLine Stealer RisePro SmokeLoader Socks5Systemz Stealc STOP
2023-12-13 ⋅ cocomelonc ⋅ cocomelonc
Malware in the wild book
AsyncRAT Babuk BlackCat BlackLotus Carbanak HelloKitty Paradise Stealc WinDealer
2023-12-05 ⋅ Medium g0njxa ⋅ g0njxa
Approaching stealers devs : a brief interview with StealC
Stealc
2023-10-12 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q3 2023
FluBot AsyncRAT Ave Maria Cobalt Strike DCRat Havoc IcedID ISFB Nanocore RAT NjRAT QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Stealc Tofsee Vidar
2023-10-03 ⋅ Glyc3rius
Stealc Malware Analysis
Stealc
2023-09-25 ⋅ EchoCTI ⋅ Bilal BAKARTEPE, bixploit
StealC Technical Analysis Report
Stealc
2023-08-24 ⋅ Github (muha2xmad) ⋅ Muhammad Hasan Ali
StealC configuration extractor
Stealc
2023-08-15 ⋅ Github (muha2xmad) ⋅ Muhammad Hasan Ali
StealC string decryption
Stealc
2023-08-15 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
StealC Delivered via Deceptive Google Sheets
Stealc
2023-05-05 ⋅ VMRay ⋅ VMRay Labs Team
Stealc: A new stealer emerges in 2023
Stealc
2023-02-27 ⋅ Sekoia ⋅ Quentin Bourgue, Threat & Detection Research Team
Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity – Part 2
Stealc
2023-02-20 ⋅ Sekoia ⋅ Pierre Le Bourhis, Quentin Bourgue, Threat & Detection Research Team
Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity – Part 1
Stealc
2023-02-03 ⋅ Cloudsek ⋅ Deepanjli Paulraj, Pavan Karthick M
Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware
Alfonso Stealer Bandit Stealer Cameleon Fabookie Lumma Stealer Nanocore RAT Panda Stealer PureLogs Stealer RecordBreaker RedLine Stealer Stealc STOP Vidar
Yara Rules
[TLP:WHITE] win_stealc_auto (20260917 | Detects win.stealc.)
rule win_stealc_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.stealc."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? e8???????? 81c480000000 e9???????? }
            // n = 4, score = 600
            //   e8????????           |                     
            //   e8????????           |                     
            //   81c480000000         | add                 esp, 0x80
            //   e9????????           |                     

        $sequence_1 = { e8???????? 83c460 e8???????? 83c40c }
            // n = 4, score = 600
            //   e8????????           |                     
            //   83c460               | add                 esp, 0x60
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_2 = { 50 e8???????? e8???????? 81c484000000 }
            // n = 4, score = 600
            //   50                   | push                eax
            //   e8????????           |                     
            //   e8????????           |                     
            //   81c484000000         | add                 esp, 0x84

        $sequence_3 = { ff15???????? 85c0 7507 c685e0feffff43 }
            // n = 4, score = 600
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7507                 | jne                 9
            //   c685e0feffff43       | mov                 byte ptr [ebp - 0x120], 0x43

        $sequence_4 = { 68???????? e8???????? e8???????? 83c474 }
            // n = 4, score = 600
            //   68????????           |                     
            //   e8????????           |                     
            //   e8????????           |                     
            //   83c474               | add                 esp, 0x74

        $sequence_5 = { e8???????? e8???????? 83c418 6a3c }
            // n = 4, score = 600
            //   e8????????           |                     
            //   e8????????           |                     
            //   83c418               | add                 esp, 0x18
            //   6a3c                 | push                0x3c

        $sequence_6 = { 8d85dcf7ffff 50 ff15???????? 85c0 0f84a1000000 }
            // n = 5, score = 400
            //   8d85dcf7ffff         | lea                 eax, [ebp - 0x824]
            //   50                   | push                eax
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   0f84a1000000         | je                  0xa7

        $sequence_7 = { 69c90ba31400 2bca 884c0588 48ffc0 }
            // n = 4, score = 400
            //   69c90ba31400         | mov                 dword ptr [esp + 0x70], ecx
            //   2bca                 | dec                 ecx
            //   884c0588             | mov                 ecx, esp
            //   48ffc0               | inc                 esp

        $sequence_8 = { 8d85dcf7ffff 50 8b450c 53 ff30 895df0 }
            // n = 6, score = 400
            //   8d85dcf7ffff         | lea                 eax, [ebp - 0x824]
            //   50                   | push                eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   53                   | push                ebx
            //   ff30                 | push                dword ptr [eax]
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx

        $sequence_9 = { 69c10ba31400 894d80 2bc2 66894584 69c187fd701e }
            // n = 5, score = 400
            //   69c10ba31400         | movzx               ecx, byte ptr [ebp - 0x73]
            //   894d80               | inc                 esp
            //   2bc2                 | movzx               edx, byte ptr [ebp - 0x74]
            //   66894584             | inc                 esp
            //   69c187fd701e         | movzx               ebx, byte ptr [ebp - 0x75]

        $sequence_10 = { 4c8be0 440fb6458e 440fb64d8d 440fb6558c 440fb65d8b }
            // n = 5, score = 400
            //   4c8be0               | dec                 esp
            //   440fb6458e           | mov                 esp, eax
            //   440fb64d8d           | inc                 esp
            //   440fb6558c           | movzx               eax, byte ptr [ebp - 0x72]
            //   440fb65d8b           | inc                 esp

        $sequence_11 = { 66894584 69c187fd701e b934eddb95 2bc8 }
            // n = 4, score = 400
            //   66894584             | dec                 eax
            //   69c187fd701e         | cmp                 eax, 8
            //   b934eddb95           | movzx               ecx, byte ptr [ebp - 0x71]
            //   2bc8                 | dec                 esp

        $sequence_12 = { 440fb77586 440fb77d84 894c2470 498bcc 4489442468 }
            // n = 5, score = 400
            //   440fb77586           | imul                eax, ecx, 0x1e70fd87
            //   440fb77d84           | mov                 ecx, 0x95dbed34
            //   894c2470             | mov                 word ptr [ebp - 0x7a], cx
            //   498bcc               | imul                ecx, ecx, 0x14a30b
            //   4489442468           | sub                 ecx, edx

        $sequence_13 = { 0fb67d89 0fb67588 440fb77586 440fb77d84 }
            // n = 4, score = 400
            //   0fb67d89             | mov                 dword ptr [ebp - 0x80], ecx
            //   0fb67588             | sub                 eax, edx
            //   440fb77586           | mov                 word ptr [ebp - 0x7c], ax
            //   440fb77d84           | imul                eax, ecx, 0x1e70fd87

        $sequence_14 = { e8???????? 0fb64d8f 4c8be0 440fb6458e }
            // n = 4, score = 400
            //   e8????????           |                     
            //   0fb64d8f             | mov                 byte ptr [ebp + eax - 0x78], cl
            //   4c8be0               | dec                 eax
            //   440fb6458e           | inc                 eax

        $sequence_15 = { ff15???????? 85c0 750a b043 }
            // n = 4, score = 400
            //   ff15????????         |                     
            //   85c0                 | mov                 esp, eax
            //   750a                 | inc                 esp
            //   b043                 | movzx               eax, byte ptr [ebp - 0x72]

        $sequence_16 = { e8???????? e8???????? 83c47c e9???????? }
            // n = 4, score = 300
            //   e8????????           |                     
            //   e8????????           |                     
            //   83c47c               | add                 esp, 0x7c
            //   e9????????           |                     

        $sequence_17 = { 8bcc 8d95a0f5ffff 52 e8???????? e8???????? 83c414 }
            // n = 6, score = 200
            //   8bcc                 | mov                 ecx, esp
            //   8d95a0f5ffff         | lea                 edx, [ebp - 0xa60]
            //   52                   | push                edx
            //   e8????????           |                     
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14

    condition:
        7 of them and filesize < 4891648
}
[TLP:WHITE] win_stealc_w0   (20230221 | Find standalone Stealc sample based on decryption routine or characteristic strings)
rule win_stealc_w0 {
   meta:
       malware = "Stealc"
       description = "Find standalone Stealc sample based on decryption routine or characteristic strings"
       source = "SEKOIA.IO"
       reference = "https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/"
       classification = "TLP:CLEAR"
       hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
       author = "crep1x"
       malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc"
       malpedia_version = "20230221"
       malpedia_license = "CC BY-NC-SA 4.0"
       malpedia_sharing = "TLP:WHITE"
       malpedia_rule_date = "20230221"
       malpedia_hash = ""
   strings:
       $dec = { 55 8b ec 8b 4d ?? 83 ec 0c 56 57 e8 ?? ?? ?? ?? 6a 03 33 d2 8b f8 59 f7 f1 8b c7 85 d2 74 04 } //deobfuscation function

       $str01 = "------" ascii
       $str02 = "Network Info:" ascii
       $str03 = "- IP: IP?" ascii
       $str04 = "- Country: ISO?" ascii
       $str05 = "- Display Resolution:" ascii
       $str06 = "User Agents:" ascii
       $str07 = "%s\\%s\\%s" ascii

   condition:
       uint16(0) == 0x5A4D and ($dec or 5 of ($str*))
}
Download all Yara Rules