StealC seller relaunches as Stadia RAT for Windows
Original title: StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs
Version 1.1.2 adds hidden desktop control, a shell, and a loader; Varonis ties its helper to StealC 3.5.
Varonis Threat Labs says the StealC seller advertised Stadia on October 16, 2026, a Windows remote-access trojan that steals credentials and offers hidden desktop control. A tested build, version 1.1.2, shares a browser-encryption helper byte for byte with StealC 3.5. Stadia has six modules, contacts three hard-coded HTTP servers, and the seller prices Basic, Team, and Pro at $300, $550, and $900 a month. The report does not establish delivery or an infection count.
Unconfirmed: Delivery method and infection counts are not established; collection scope is the seller's advertisement.
- Operation Endgame seized 326 servers and 142 domains, Varonis says, citing June.
- The seller claims more than 50 browsers, 120 crypto extensions, and 50 wallets.
- Only the $900 Pro tier includes all six modules; former StealC buyers get one free Pro month.
- The sample is an unsigned 560,128-byte 32-bit executable that adds Defender exclusions when elevated.
- It skips Russian, Ukrainian, Belarusian, Kazakh, and Uzbek language settings.
Impact: stolen credentials plus hidden remote control of Windows PCs
- 1.Hunt for browser-process injection, hidden logon tasks, and new Microsoft Defender exclusions.
- 2.Treat HTTP bodies labeled JSON but carrying RC4 and Base64 data as suspicious.
- 3.Prefer behavior detection because Varonis says C2 addresses and keys change between builds.
- ATT&CK
- T1555.003 Credentials from Web BrowsersT1055 Process InjectionT1053.005 Scheduled TaskT1562.001 Disable or Modify ToolsT1071.001 Web Protocols
- Organizations
- Varonis Threat Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | stadiadev.cc | Third C2 hxxp://193[.]148[.]56[.]97/ Failover Panel domain stadiadev[.]cc Operator panel RC4 string key eepkTOgSwdNCgrhITR Build-sp |
| ipv4 | 193.148.56.97 | ndary C2 hxxp://91[.]92[.]43[.]45/ Failover Third C2 hxxp://193[.]148[.]56[.]97/ Failover Panel domain stadiadev[.]cc Operator panel |
| ipv4 | 91.92.43.45 | hxxp://93[.]152[.]213[.]215/ HTTP POST Secondary C2 hxxp://91[.]92[.]43[.]45/ Failover Third C2 hxxp://193[.]148[.]56[.]97/ Failov |
| ipv4 | 93.152.213.215 | e050d08d5269733c4ea4 Shared StealC helper Primary C2 hxxp://93[.]152[.]213[.]215/ HTTP POST Secondary C2 hxxp://91[.]92[.]43[.]45/ Fai |
| md5 | 028afae8b5e9953e1cd84a003c42fd85 | le MD5 7739a8d0d101ca82b93bbd0acdb6d9af Same sample Imphash 028afae8b5e9953e1cd84a003c42fd85 Outer executable Helper SHA-256 0e5337a4cc8ebc772bc50f6e79b |
| md5 | 7739a8d0d101ca82b93bbd0acdb6d9af | -1 1ba76d2029744cc6e2f7209c96a696b32962b1f1 Same sample MD5 7739a8d0d101ca82b93bbd0acdb6d9af Same sample Imphash 028afae8b5e9953e1cd84a003c42fd85 Outer |
| sha1 | 1ba76d2029744cc6e2f7209c96a696b32962b1f1 | 8141d39a502a4324889fb732e74b44bfee12c72137dd73e Agent SHA-1 1ba76d2029744cc6e2f7209c96a696b32962b1f1 Same sample MD5 7739a8d0d101ca82b93bbd0acdb6d9af Same sampl |
| sha256 | 0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4 | ae8b5e9953e1cd84a003c42fd85 Outer executable Helper SHA-256 0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4 Shared StealC helper Primary C2 hxxp://93[.]152[.]213[.]215 |
| sha256 | ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e | Indicator Context Sample stadia_x32.exe Agent 1.1.2 SHA-256 ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e Agent SHA-1 1ba76d2029744cc6e2f7209c96a696b32962b1f1 Same s |
| url | http://193.148.56.97/ | ST Secondary C2 hxxp://91[.]92[.]43[.]45/ Failover Third C2 hxxp://193[.]148[.]56[.]97/ Failover Panel domain stadiadev[.]cc Operator panel R |
| url | http://91.92.43.45/ | mary C2 hxxp://93[.]152[.]213[.]215/ HTTP POST Secondary C2 hxxp://91[.]92[.]43[.]45/ Failover Third C2 hxxp://193[.]148[.]56[.]97/ Failove |
| url | http://93.152.213.215/ | 3410022e050d08d5269733c4ea4 Shared StealC helper Primary C2 hxxp://93[.]152[.]213[.]215/ HTTP POST Secondary C2 hxxp://91[.]92[.]43[.]45/ Fail |
From the original article
3 min read at cybersecuritynews.com
The seller behind StealC has returned with Stadia, a Windows remote access trojan that combines password theft with hidden desktop control. Advertised on October 16, 2026, the malware expands beyond stealing data, allowing criminals to run commands, browse files, manage processes, and load more malicious software. The return follows June’s Operation Endgame disruption.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.