/
← Voltar ao feed
high

StealC developer relaunches as Stadia, a modular RAT with HVNC, after Operation Endgame disruption

1 fonte(s) · 1 atualização(ões) · publicado 23/10/2026 09:34 · coletado há 3 horas

The seller of the StealC infostealer began advertising Stadia on October 16. It is a subscription-based modular remote access trojan that pairs credential theft with hidden desktop control. Varonis Threat Labs obtained a build, reverse engineered it and found StealC code inside the agent. The panel changelog records an upgrade to the StealC 3.5.0 stealer module. The launch follows the June Operation Endgame action against StealC, Amadey and SocGholish, and shows that infrastructure takedowns did not remove the developer. Former StealC customers are offered a free month of the Pro tier.

Detalhes técnicos

  • Stadia has six modules: hidden VNC (HVNC), stealer, Remote CMD, loader, File Explorer and Process Manager. HVNC works on the current session or on an isolated hidden desktop.
  • The loader supports EXE, PowerShell, CMD and MSI payloads, executed from disk or memory.
  • The stealer targets more than 50 browsers, more than 120 cryptocurrency extensions and more than 50 desktop wallets. It also targets messengers, gaming sessions, email clients, VPN software and session tokens (Chrome, Discord, Steam, Roblox, Azure).
  • Pricing is $300 per month (Basic), $550 (Team) and $900 (Pro). Only Pro includes all six modules.
  • The analyzed sample is stadia_x32.exe, an unsigned 560,128-byte MSVC binary that identifies as STADIA_BETA v1.1.2. It imports only KERNEL32.dll and resolves most APIs dynamically. Strings (542 recovered) are protected with RC4 and Base64.
  • The agent exits on Russian, Ukrainian, Belarusian, Kazakh and Uzbek system locales and uses a username-and-computername mutex.
  • It has three C2 servers: 93.152.213.215, 91.92.43.45 and 193.148.56.97. Traffic is plain HTTP carrying Base64-encoded, RC4-encrypted JSON under an application/json content type. The agent retries after 300 seconds if no server responds.
  • Persistence: it installs under a random 12-character directory in C:\ProgramData with updater-like names (MicrosoftEdgeUpdate.exe, RuntimeBroker.exe, GoogleUpdate.exe). A hidden scheduled task runs at logon and every 15 minutes. When elevated, it adds the install directory to Microsoft Defender exclusions via PowerShell.
  • Sample SHA-256: ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e.
  • The Endgame figures cited by Europol (326 servers, 142 domains, about 27 million credentials) describe the whole operation, not StealC alone.

Remediação

  • Hunt for unexpected updater-named binaries under C:\ProgramData in random 12-character directories.
  • Review hidden scheduled tasks that run at logon and every 15 minutes.
  • Review Defender exclusion changes made through PowerShell.
  • Correlate these artifacts with connections to the listed C2 IPs.
  • Do not rely on filenames alone; location, task configuration and exclusion changes are better pivots.

Linha do tempo

  1. gbhackers.com ↗ · pub. 23/10/2026 09:34 · coletado 23/10 10:00 primeiro registro

    StealC developer relaunches as Stadia, a modular RAT with HVNC, after Operation Endgame disruption

    ler a análise desta fonte

    The seller of the StealC infostealer began advertising Stadia on October 16. It is a subscription-based modular remote access trojan that pairs credential theft with hidden desktop control. Varonis Threat Labs obtained a build, reverse engineered it and found StealC code inside the agent. The panel changelog records an upgrade to the StealC 3.5.0 stealer module. The launch follows the June Operation Endgame action against StealC, Amadey and SocGholish, and shows that infrastructure takedowns did not remove the developer. Former StealC customers are offered a free month of the Pro tier.

    Technical Details

    • Stadia has six modules: hidden VNC (HVNC), stealer, Remote CMD, loader, File Explorer and Process Manager. HVNC works on the current session or on an isolated hidden desktop.
    • The loader supports EXE, PowerShell, CMD and MSI payloads, executed from disk or memory.
    • The stealer targets more than 50 browsers, more than 120 cryptocurrency extensions and more than 50 desktop wallets. It also targets messengers, gaming sessions, email clients, VPN software and session tokens (Chrome, Discord, Steam, Roblox, Azure).
    • Pricing is $300 per month (Basic), $550 (Team) and $900 (Pro). Only Pro includes all six modules.
    • The analyzed sample is stadia_x32.exe, an unsigned 560,128-byte MSVC binary that identifies as STADIA_BETA v1.1.2. It imports only KERNEL32.dll and resolves most APIs dynamically. Strings (542 recovered) are protected with RC4 and Base64.
    • The agent exits on Russian, Ukrainian, Belarusian, Kazakh and Uzbek system locales and uses a username-and-computername mutex.
    • It has three C2 servers: 93.152.213.215, 91.92.43.45 and 193.148.56.97. Traffic is plain HTTP carrying Base64-encoded, RC4-encrypted JSON under an application/json content type. The agent retries after 300 seconds if no server responds.
    • Persistence: it installs under a random 12-character directory in C:\ProgramData with updater-like names (MicrosoftEdgeUpdate.exe, RuntimeBroker.exe, GoogleUpdate.exe). A hidden scheduled task runs at logon and every 15 minutes. When elevated, it adds the install directory to Microsoft Defender exclusions via PowerShell.
    • Sample SHA-256: ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e.
    • The Endgame figures cited by Europol (326 servers, 142 domains, about 27 million credentials) describe the whole operation, not StealC alone.

    Remediation

    • Hunt for unexpected updater-named binaries under C:\ProgramData in random 12-character directories.
    • Review hidden scheduled tasks that run at logon and every 15 minutes.
    • Review Defender exclusion changes made through PowerShell.
    • Correlate these artifacts with connections to the listed C2 IPs.
    • Do not rely on filenames alone; location, task configuration and exclusion changes are better pivots.