StealC Infostealer Europol operatsiyasidan so'ng kuchli masofaviy kirish troyan sifatida qaytdi

StealC sotuvchisi Stadia nomli modulli masofaviy kirish troyani bilan qayta paydo bo'ldi, bu esa buzilgan infostealerni doimiy endpoint nazorati platformasiga kengaytiradi.

16-oktabrda e'lon qilingan zararli dastur, Varonis Threat Labs tadqiqotiga ko'ra, ma'lumot o'g'irlashni yashirin ish stoli kirishi, buyruq bajarilishi, fayl boshqaruvi va yuklama yetkazib berish bilan birlashtiradi.

Qaytish iyun oyidagi StealC, Amadey va SocGholishga qarshi Operation Endgame harakatidan keyin sodir bo'ldi.

Europol xabar berishicha, operatsiya davomida hokimiyat va xususiy hamkorlar 326 ta server va 142 ta domenni nazoratga oldi, taxminan 27 million o'g'irlangan ma'lumotni qayta tikladi. Bu raqamlar faqat StealCga emas, balki muvofiqlashtirilgan kampaniyaga tegishli.

Ularning tahlili yangi agent ichida StealC kodini aniqladi. Shu bilan birga, panelning o'zgarishlar jurnalida StealC 3.5.0 o'g'irlovchi moduliga yangilanish aniq qayd etilgan.

Stadia oltita modulni taklif qiladi: yashirin virtual tarmoq hisoblash, o'g'irlovchi, Remote CMD, yuklovchi, File Explorer va Process Manager.

Ish stoli kirishi ham joriy sessiyani, ham izolyatsiya qilingan yashirin ish stolini qo'llab-quvvatlaydi, bu esa operatorlarga buzilgan tizimlar bilan jabrlanuvchining ko'rinadigan ish maydonidan tashqarida o'zaro aloqada bo'lish imkonini beradi.

Yuklovchi EXE, PowerShell, CMD va MSI yuklamalarini qo'llab-quvvatlashini e'lon qiladi, disk yoki xotirada bajarish variantlari bilan.

O'g'irlovchi 50 dan ortiq brauzer, 120 dan ortiq kriptovalyuta kengaytmasi va 50 dan ortiq ish stoli hamyonini, shuningdek, xabar almashish ilovalari, o'yin sessiyalari, elektron pochta mijozlari va VPN dasturlarini nishonga oladi.

HVNC skrinshoti Windows 11 mashinasida yuqtirilgan tizimda jonli masofaviy ish stoli sessiyasini ko'rsatadi, jabrlanuvchining ish stolida ispan tilidagi ish vaqti xato dialogi joylashgan.

Sotuvchining asboblar paneli (Manba: Varonis).

Varonis tadqiqotchilari Stadia qurilmasini oldi, uning bajariladigan faylini teskari muhandislik qildi va uning boshqaruv paneli nazorat qilinadigan Windows xosti bilan aloqa qilayotganini kuzatdi.

StealC zararli dasturi qayta paydo bo'ldi

Obunalar oyiga 300 dollar (Basic), 550 dollar (Team) va 900 dollar (Pro) turadi. Faqat Pro barcha oltita modulni o'z ichiga oladi. Avvalgi StealC mijozlari bepul Pro oyini oladi, bu esa qayta ishga tushirishni sotuvchining mavjud mijoz bazasi bilan to'g'ridan-to'g'ri bog'laydi.

Tahlil qilingan namuna, stadia_x32.exe, imzosiz, 560 128 baytli Windows bajariladigan fayl bo'lib, Microsoft Visual C++ bilan kompilyatsiya qilingan.

OpenRemoteDesktop (Manba: Varonis).

Quruvchi yorlig'i agentlarni joriy e'lon qilingan versiyadan kompilyatsiya qiladi. Operatorlar qurilma yaratadi, .exe faylini yuklab oladi va uni joylashtiradi.

Yon panel o'g'irlangan ma'lumotlarni tur bo'yicha tartiblaydi: parollar, kredit kartalari, xabar almashuvchilar, dasturiy ta'minot, Chrome, Discord, Steam, Roblox va Azure uchun sessiya tokenlari, shuningdek, urug' iboralari uchun kripto bo'limi.

U o'zini STADIA_BETA deb aniqlaydi, 1.1.2 versiyasini xabar qiladi va faqat KERNEL32.dll ni import qiladi, ko'pchilik operatsion API-larni dinamik ravishda hal qiladi.

Garchi ochilmagan bo'lsa-da, binar ma'noli satrlarni RC4 shifrlash va keyin Base64 kodlash yordamida yashiradi.

Tadqiqotchilar 542 ta satrni tikladi, bu esa konfiguratsiya ma'lumotlari, buyruq lug'ati, brauzer nishonlari va doimiylik shablonlarini ochib berdi.

O'rnatishdan oldin, Stadia tizim tilini tekshiradi va rus, ukrain, belarus, qozoq va o'zbek lokalizatsiyalari uchun chiqib ketadi. O'rnatilgan agentlar takroriy bajarilishni oldini olish uchun foydalanuvchi nomi va kompyuter nomi mutexidan foydalanadi.

Uning konfiguratsiyasi uchta buyruq serverini o'z ichiga oladi: 93.152.213.215, 91.92.43.45 va 193.148.56.97.

Ulanishlar oddiy HTTP dan foydalanadi, lekin xabar tanalari Base64 kodlangan, RC4 shifrlangan JSON ni o'z ichiga oladi, garchi application/json kontent turini e'lon qilsa ham. Agent serverlarni ketma-ket sinovdan o'tkazadi va agar hech biri javob bermasa, 300 soniyadan keyin qayta urinadi.

Stadia C:\ProgramData ichida tasodifiy, 12 belgili katalog ostida o'rnatiladi, MicrosoftEdgeUpdate.exe, RuntimeBroker.exe yoki GoogleUpdate.exe kabi fayl nomlarini qabul qiladi.

Yashirin rejalashtirilgan vazifa uni tizimga kirishda va har 15 daqiqada ishga tushiradi, sozlangan davomiyligi 3650 kun.

Yuqori huquqlarga ega bo'lganda, agent shuningdek, Microsoft Defender istisnolariga o'rnatish katalogini qo'shish uchun PowerShell ni chaqiradi.

Bu kombinatsiya bajariladigan fayl joylashuvi, vazifa konfiguratsiyasi va istisno o'zgarishlarini faqat fayl nomlaridan ko'ra foydaliroq tekshiruv kontekstiga aylantiradi.

Shubhali yuqtirishni tekshirayotgan himoyachilar bu artefaktlarni xabar qilingan infratuzilma bilan ulanishlar bilan bog'lashlari va ProgramData ostidagi kutilmagan yangilovchi binar fayllarni tekshirishlari kerak.

Namunaning SHA-256: ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e.

Qayta paydo bo'lish infratuzilma buzilishi va ishlab chiquvchini yo'q qilish o'rtasidagi farqni ko'rsatadi: Stadia StealC ning o'g'irlash qobiliyatini saqlab qoladi, shu bilan birga uni jinoiy operatorlar buzilgan Windows endpointlariga doimiy kirish izlayotgan kengroq, obunaga asoslangan masofaviy kirish vositalari to'plamiga joylashtiradi.

Buzilish ko'rsatkichlari

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishni oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedkasi platformalarida qayta fang qiling.

StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted infostealer into a platform for persistent endpoint control.

Advertised on October 16, the malware combines credential theft with hidden desktop access, command execution, file management, and payload delivery, according to research supplied by Varonis Threat Labs.

The comeback follows June’s Operation Endgame action against StealC, Amadey and SocGholish.

Europol reported that authorities and private partners actioned 326 servers and 142 domains across the operation, recovering approximately 27 million stolen credentials. Those figures describe the coordinated campaign, not StealC alone.

Their analysis identified StealC code inside the new agent. At the same time, the panel’s changelog explicitly recorded an upgrade to the StealC 3.5.0 stealer module.

Stadia offers six modules: hidden virtual network computing, a stealer, Remote CMD, a loader, File Explorer and Process Manager.

Desktop access supports both the current session and an isolated hidden desktop, allowing operators to interact with compromised systems outside the victim’s visible workspace.

The loader advertises support for EXE, PowerShell, CMD and MSI payloads, with disk or memory execution options.

The stealer targets more than 50 browsers, over 120 cryptocurrency extensions and more than 50 desktop wallets, alongside messaging applications, gaming sessions, email clients and VPN software.

The HVNC screenshot is a live remote-desktop session on an infected Windows 11 machine, with a Spanish-language runtime error dialog sitting on the victim’s desktop.

Seller’s toolbar (Source : Varonis).

Varonis researchers obtained a Stadia build, reverse engineered its executable and observed its management panel communicating with a controlled Windows host.

StealC Malware Resurfaces

Subscriptions cost $300 monthly for Basic, $550 for Team and $900 for Pro. Only Pro includes all six modules. Former StealC customers receive a free Pro month, directly linking the relaunch to the seller’s existing customer base.

The analyzed sample, stadia_x32.exe, is an unsigned, 560,128-byte Windows executable compiled with Microsoft Visual C++.

OpenRemoteDesktop (Source : Varonis).

The builder tab compiles agents from the current published version. Operators create a build, download the .exe, and deploy it.

The sidebar organizes stolen data by type: passwords, credit cards, messengers, software, session tokens for Chrome, Discord, Steam, Roblox, and Azure, and a crypto section for seed phrases.

It identifies itself as STADIA_BETA, reports version 1.1.2 and imports only KERNEL32.dll, resolving most operational APIs dynamically.

Although unpacked, the binary obscures meaningful strings using RC4 encryption followed by Base64 encoding.

Researchers recovered 542 strings, exposing configuration data, command vocabulary, browser targets and persistence templates.

Before installation, Stadia checks the system language and exits for Russian, Ukrainian, Belarusian, Kazakh and Uzbek locales. Installed agents use a username-and-computername mutex to prevent duplicate execution.

Its configuration contains three command servers: 93.152.213.215, 91.92.43.45 and 193.148.56.97.

Connections use plain HTTP, but message bodies contain Base64-encoded, RC4-encrypted JSON despite declaring an application/json content type. The agent tests servers sequentially and retries after 300 seconds if none responds.

Stadia installs beneath a randomized, 12-character directory in C:\ProgramData, adopting filenames such as MicrosoftEdgeUpdate.exe, RuntimeBroker.exe or GoogleUpdate.exe.

A hidden scheduled task launches it at logon and every 15 minutes, with a configured duration of 3,650 days.

When elevated, the agent also invokes PowerShell to add its installation directory to Microsoft Defender exclusions.

This combination makes executable location, task configuration and exclusion changes more useful investigative context than filenames alone.

Defenders investigating suspected infections should correlate these artifacts with connections to the reported infrastructure and inspect unexpected updater binaries under ProgramData.

The sample’s SHA-256 is ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e.

The resurgence illustrates the distinction between infrastructure disruption and developer removal: Stadia preserves StealC’s theft capability while packaging it inside a broader, subscription-based remote intrusion toolkit for criminal operators seeking sustained access to compromised Windows endpoints.

Indicators of compromise

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.