216.73.217.139

I StealC You: Tracking the Rapid Changes To Steal

· Published 02/05/2025 06:23 · Modified 02/05/2025 21:27

Export JSON

Essential information

Published
02/05/2025 06:23
Modified
02/05/2025 21:27
Tags
2025-05-02 amadey credential harvesting information stealer obfuscation rc4 encryption stealc
Related entities
1 intrusion sets (apt), 16 techniques (mitre), 1 malware

Description

V2, introduced in March 2025, is an enhanced version of the popular and malware downloader. Key updates include a streamlined JSON-based C2 communication protocol with , expanded payload delivery options (MSI packages and PowerShell scripts), and a redesigned control panel with an integrated builder. New features comprise multi-monitor screenshot capture, a unified file grabber, and server-side brute-forcing for credentials. The malware now supports customizable payload delivery rules based on geolocation, hardware IDs, and installed software. Technical analysis reveals improvements in , API resolution, and configuration encryption. V2 is actively developed and frequently used in conjunction with other malware families like .

External references