SYMBOLCOMMON_NAMEaka. SYNONYMS
win.stealerium (Back to overview)

Stealerium

According to SecurityScorecard, Stealerium is an open-source stealer available on GitHub. The malware steals information from browsers, cryptocurrency wallets, and applications such as Discord, Pidgin, Outlook, Telegram, Skype, Element, Signal, Tox, Steam, Minecraft, and VPN clients. The binary also gathers data about the infected host, such as the running processes, Desktop and webcam screenshots, Wi-Fi networks, the Windows product key, and the public and private IP address. The stealer employs multiple anti-analysis techniques, such as detecting virtual machines, sandboxes, and malware analysis tools and checking if the process is being debugged. The malware also embedded a keylogger module and a clipper module that replaces cryptocurrency wallet addresses with the threat actor’s addresses if the victim makes a transaction. The stolen information is sent to a Discord channel using a Discord Webhook.

References
2025-06-23 ⋅ cegeka ⋅ Christos Katopis, Cristina Aldea
StealeriumPy: A Stealerium variant distributed through ClickFix
Stealerium
2023-02-07 ⋅ SecurityScorecard ⋅ Vlad Pasca
A Detailed Analysis of a New Stealer Called Stealerium
Stealerium
2022-04-24 ⋅ Github (Stealerium) ⋅ kgnfth
Github Repository for Stealerium
Stealerium
Yara Rules
[TLP:WHITE] win_stealerium_w0 (20250909 | Detects Stealerium variant based on string and hashes)
import "hash"

rule win_stealerium_w0 {
	meta:
        description = "Detects Stealerium variant based on string and hashes"
        author = " Cristina Aldea & Christos Katopis, Cegeka CSIRT"
        date = "04 -06-2025"
        sample = "14e9840bdf98de7b9ad8aa0e9fc395ed7aefd31d75e92f7b5ab34a1d195a1328"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealerium"
        malpedia_version = "20250909"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:

        //Stealerium loader strings
        $lds1="sDCTYKS" nocase
        $lds2="xbase_library.zip" nocase
        //Stealerium payload URL strings
        $murls1="/api/ws/v1/endpoint" nocase wide
        $murls2="/api/ws/v1/endpoint" nocase wide
        $murls3="/api/bot/v1/register" nocase wide
        $murls4="/api/bot/v1/log-file" nocase wide
        //Stealerium payload Mutex
        $mmutexs1="QT1bm11ocWPp" nocase wide
        //Stealerium payload stealer target strings
        $bs1="telegram" nocase wide
        $bs2="skype" nocase wide
        $bs3="viber" nocase wide
        $bs4="facebook" nocase wide
        $bs5="messenger" nocase wide
        $bs6="discord" nocase wide
        $bs7="open-vpn" nocase wide
        $bs8="proton-vpn" nocase wide
        $bs9="nord-vpn" nocase wide
        $bs10="edge" nocase wide
        $bs11="chromium" nocase wide
        $bs12="chrome" nocase wide
        $bs13="Firefox" nocase wide
        $bs14="clipboard.txt" nocase wide
        $bs15="cookies.txt" nocase wide
        $bs16="credit-cards.txt" nocase wide
        $bs17="bookmarks.txt" nocase wide
        $bs18="passwords.txt" nocase wide
        $bs19="gmail" nocase wide
        $bs20="protonmail" nocase wide
        $bs21="outlook" nocase wide
        $bs22="paypal" nocase wide
        $bs23="bitcoin" nocase wide
        $bs24="monero" nocase wide
        $bs25="dashcoin" nocase wide
        $bs26="litecoin" nocase wide
        $bs27="etherium" nocase wide
        $bs28="SelfDestruct" nocase wide
        $bs29="FileZilla" nocase wide
        $bs30="Minecraft" nocase wide
        $bs31="battle-net" nocase wide
        $bs32="steam" nocase wide
    condition:
        //Stealerium loader hash
        (hash.sha256(0,filesize)=="afd059bc44d65f346ab3c832d1025303622f37446a85736de2a69ebc30c111a3") or
        //Stealerium payload hash
        (hash.sha256(0,filesize )=="3cf771bfc2a9e7d5d46f55eb0a3eddc5618f5b2d01f3a0cad7adce74c76876") or
        //Stealerium payload Python byte -code hash
        (hash.sha256(0,filesize )=="7251ee49a145289008d1996d1ef83299de1876f42aa2bbe2b1834b62d5514b6d") or
        all of ($ld*) or any of ($m*) or all of ($b*)
}
Download all Yara Rules