Researchers Discover Numerous Samples of Information Stealer ‘Stealc’ in the Wild

Feb 21, 2023Ravie LakshmananCyber Threat Intelligence

A new information stealer called Stealc that’s
being advertised on the dark web could emerge as a worthy
competitor to other malware of its ilk.

“The threat actor presents Stealc as a fully featured and
ready-to-use stealer, whose development relied on Vidar^[1], Raccoon^[2], Mars^[3], and RedLine^[4]
stealers,” SEKOIA said^[5]
in a Monday report.

The French cybersecurity company said it discovered^[6]
more than^[7]
40 Stealc samples^[8]
distributed in the wild and 35 active command-and-control (C2)
servers, suggesting that the malware is already gaining traction
among criminal groups.

Stealc, first marketed by an actor named Plymouth on the XSS and
BHF Russian-speaking underground forums on January 9, 2023, is
written in C and comes with capabilities to steal data from web
browsers, crypto wallets, email clients, and messaging apps.

The malware-as-a-service (MaaS) also boasts of a “customizable”
file grabber that allows its buyers to tailor the module to siphon
files of interest. It further implements loader capabilities to
deploy additional payloads.

SEKOIA assessed with “high confidence that its alleged developer
quickly established itself as a reliable threat actor, and its
malware gained the trust of cybercriminals dealing with
infostealers.”

Among the distribution vectors used to deliver Stealc are
YouTube videos posted from compromised accounts that link to a
website peddling cracked software (“rcc-software[.]com”).

This also indicates that users searching for ways to install
pirated software on YouTube are a target, mirroring the same tactic
adopted by another infostealer dubbed Aurora^[9].

“Since customers of the Stealc MaaS own a build of its
administration panel to host the stealer C2 server and generate
stealer samples themselves, it is likely that the build will leak
into the underground communities in the medium term,” the company
added.

According to antivirus vendor Avast, FormBook^[10], Agent Tesla^[11], RedLine, LokiBot^[12], Raccoon, Snake Keylogger^[13], and Arkei^[14] (along with its fork
Vidar) accounted for the most prevalent stealer malware
strains^[15] during Q4 2022.