Stealc

StealC is a form of malware that specifically targets browser extensions and password managers. Its emergence was first reported in early 2023 and it quickly grew in popularity on the dark web due to its ability to bypass traditional security measures. The malware's modus operandi involves stealing credentials stored in web browsers and password managers, making it particularly dangerous for users who rely on these tools for convenience and security. One notable incident involving StealC was the attack on the Solana blockchain in 2023, where the malware facilitated a heist amounting to $7 million. The operational mechanism of StealC involves multiple infostealers from malware families like Danabot and StealC itself being injected into explorer.exe. Once inside a system, the StealC malware communicates with a Command & Control (C2) server, with known IPs including 46.8.238.240 and 23.94.225.177. This communication allows for the download of additional malicious payloads. For instance, in an example provided by OALABS, Amadey, another malware, loads StealC and an "AutoIt2Exe" binary from a specific IP and executes them. StealC does not operate in isolation; it often works in combination with other malware to extract information. In some cases, an AutoIt script is used which, while not directly stealing credentials, aids StealC in extracting the required information. As part of the injection chain, the final stage of the malware is executed within the context of the explorer.exe process, which is a variant of the infostealer malware family StealC. This downloader is primarily responsible for delivering additional malware samples to the victim’s machine, predominantly infostealers like Danabot and StealC, and clippers.