StealC seller returns with Stadia remote access trojan
Original title: StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown
Varonis says the October 16 offering adds hidden desktop, command execution and loaders on top of StealC 3.5.0 theft.
Varonis Threat Labs says StealC’s seller advertised Stadia on October 16, a modular remote access trojan that keeps the infostealer and adds persistent Windows control. The relaunch follows June’s Operation Endgame action against StealC, Amadey and SocGholish. Stadia’s panel changelog records an upgrade to the StealC 3.5.0 stealer module. Subscriptions run from $300 to $900 a month, and only the Pro tier includes all six modules.
Unconfirmed: The 27 million credentials and server counts cover Operation Endgame, not StealC alone.
- Europol said the wider operation actioned 326 servers and 142 domains and recovered about 27 million credentials.
- The stealer targets more than 50 browsers, over 120 crypto extensions and more than 50 desktop wallets.
- Sample stadia_x32.exe is version 1.1.2 and skips Russian, Ukrainian, Belarusian, Kazakh and Uzbek locales.
- It uses three HTTP command servers, a ProgramData scheduled task and Defender exclusions when elevated.
- SHA-256 is ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e.
Impact: Credential theft plus hidden remote control of Windows endpoints
| Product | Affected |
|---|---|
| Microsoft Windows | — |
- 1.Hunt for unexpected updater binaries under C:\ProgramData and related scheduled tasks.
- 2.Check connections to 93.152.213.215, 91.92.43.45 and 193.148.56.97.
- 3.Match the published SHA-256 ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e.
- ATT&CK
- T1555.003 Credentials from Web BrowsersT1053.005 Scheduled TaskT1562.001 Disable or Modify ToolsT1059 Command and Scripting InterpreterT1027 Obfuscated Files or Information
- Vendors
- Microsoft
- Products
- Windows
- Malware
- StealCStadiaAmadeySocGholish
- Organizations
- EuropolVaronis Threat Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.148.56.97 | ains three command servers: 93.152.213.215, 91.92.43.45 and 193.148.56.97. Connections use plain HTTP, but message bodies contain Bas |
| ipv4 | 91.92.43.45 | nfiguration contains three command servers: 93.152.213.215, 91.92.43.45 and 193.148.56.97. Connections use plain HTTP, but message |
| ipv4 | 93.152.213.215 | xecution. Its configuration contains three command servers: 93.152.213.215, 91.92.43.45 and 193.148.56.97. Connections use plain HTTP, |
| md5 | 028afae8b5e9953e1cd84a003c42fd85 | le MD5 7739a8d0d101ca82b93bbd0acdb6d9af same sample Imphash 028afae8b5e9953e1cd84a003c42fd85 outer PE SHA-256 0e5337a4cc8ebc772bc50f6e79befd1e8efad34100 |
| md5 | 7739a8d0d101ca82b93bbd0acdb6d9af | -1 1ba76d2029744cc6e2f7209c96a696b32962b1f1 same sample MD5 7739a8d0d101ca82b93bbd0acdb6d9af same sample Imphash 028afae8b5e9953e1cd84a003c42fd85 outer |
| sha1 | 1ba76d2029744cc6e2f7209c96a696b32962b1f1 | 32e74b44bfee12c72137dd73e stadia_x32.exe, agent 1.1.2 SHA-1 1ba76d2029744cc6e2f7209c96a696b32962b1f1 same sample MD5 7739a8d0d101ca82b93bbd0acdb6d9af same sampl |
| sha256 | 0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4 | e Imphash 028afae8b5e9953e1cd84a003c42fd85 outer PE SHA-256 0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4 0x6600-byte App-Bound helper blob, shared with StealC 3.5 N |
| sha256 | ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e | updater binaries under ProgramData. The sample’s SHA-256 is ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e. The resurgence illustrates the distinction between infrast |
From the original article
3 min read at gbhackers.com
StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted infostealer into a platform for persistent endpoint control. Advertised on October 16, the malware combines credential theft with hidden desktop access, command execution, file management, and payload delivery, according to research supplied by Varonis Threat Labs. The comeback follows June’s […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.