Stealc Technical Intelligence Dossier

Executive Summary & Threat Architecture

Stealc is a lightweight, fully featured information stealer written in C that emerged in January 2023 on Russian-language cybercrime forums, rapidly gaining adoption as an affordable and potent alternative to Vidar and Raccoon Stealer. Created by a developer known as 'Plymouth', Stealc was explicitly modeled on the functional architectures of Vidar, Raccoon, and Mars Stealer, refining their modular downloading approach. Stealc relies on a small initial stub (often less than 80 KB) that performs comprehensive anti-analysis checks, verifying that the infected system is not running in an analysis sandbox, emulator, or CIS (Commonwealth of Independent States) locale. Once environment validation succeeds, the stub contacts its centralized command-and-control server via HTTP POST to retrieve dynamic extraction rules and legitimate third-party dynamic link libraries (such as sqlite3.dll, freebl3.dll, and nss3.dll) required to parse browser SQLite databases in memory without tripping endpoint detection. Stealc harvests credentials, autofill data, credit cards, and browsing history from over 75 web browsers, sweeps for 25+ desktop cryptocurrency wallets and 75+ browser Web3 wallet extensions, and exfiltrates session tokens from Discord, Telegram, and Outlook. Distributed through YouTube tutorials promoting software cracks, SEO-poisoned search results, and phishing archives exploiting CVE-2023-38831, Stealc finishes its routine by uploading an encrypted ZIP archive of stolen logs to the C2 and self-terminating via a command-line script that securely deletes the implant binary from disk.

Observed Threat Aliases: Stealc, Stealc Stealer, Trojan:Win32/Stealc, Win32/Stealc, Trojan.Stealc

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: vidar, mars_stealer, raccoon

Documented Downstream Variants: stealc_v1, stealc_v2

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Stealc operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• YouTube video descriptions with links to mediafire or mega hosting cracked software and video games
• Search engine optimization (SEO) poisoning leading to fake freeware download portals
• Phishing archives weaponized with exploits for WinRAR CVE-2023-38831

Host Persistence & Execution Hooks

• Ephemeral single-execution model: executes in %TEMP%, steals data, exfiltrates, and securely self-deletes
• Batch script self-deletion loop executed via cmd.exe /c timeout /t 5 & del /f /q
• Registry Run keys employed only in customized threat-actor deployments

Reference File Hashes (SHA-256)

• 098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a
• 671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b
• 8ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a5202