Dashboard

StealC

A 2023 Windows stealer that copies features from older families.

Also called
Stealc
Seen since
2023
Runs on
Windows
Sold as
Malware-as-a-service on Russian-language forums

What StealC takes

  • Browser passwords, cookies, and autofill
  • Cryptocurrency wallets and wallet extensions
  • Data from messaging and email apps
  • Files matching what the buyer asked for

How it spreads

  • Fake cracked software
  • YouTube videos with download links
  • Malicious ads

Background

StealC appeared in early 2023. Sellers advertised it as a mix of Vidar, Raccoon, and RedLine features. Like those families, it is rented to many buyers, so its logs come from many countries.

Dumps follow the same layout as the older stealers, which is why they parse the same way in the index.

Checking for your logins

Search an email, username, company domain, login URL, password, or IP. The index covers logs from every family, StealC included. A dump usually does not record which malware wrote it, so a result will not say it was StealC.

The steps afterwards are the same either way. Clean the device, then change passwords from a machine that was not infected. What to do.

Other families

  • RedLine Stealer. For years the most common Windows stealer in circulating logs.
  • Lumma Stealer. Often delivered by fake verify-you-are-human pages.
  • Vidar. A long-running Windows stealer, often dropped with other malware.
  • Raccoon Stealer. A cheap Windows stealer. Its alleged operator was arrested in 2022.
  • Atomic macOS Stealer. A macOS stealer. It prompts for the user password and opens the Keychain.

Questions

Is StealC a new family or a rename?
It is a separate family from 2023. It copies behavior from older stealers rather than being a rename of one of them.
Does StealC take messenger tokens?
Yes. Messaging and email apps are part of what it copies, along with browser data and wallets.

Search an email, username, URL, password, or IP. Open search.

More