DeerStealer
DeerStealer is a Windows-focused information stealer sold as a malware-as-a-service platform. Reporting in the provided content describes subscription tiers ranging from $200/month to $3,000/month, with higher tiers adding hidden VNC, keylogging, clipper functionality, SmartScreen bypass, and remote process management. It is characterized as a credential-focused stealer and has been observed targeting browser passwords, cookies, session tokens, autofill and credit-card data, browsing history, cryptocurrency wallets, browser extensions, Discord and Telegram tokens, messaging-session data, FTP and VPN credentials, Office documents, and OneDrive contents. Multiple reports state it targets data from more than 50 browsers, more than 800 browser extensions, and numerous desktop and hardware-wallet-related applications.
The malware has been delivered through several infection chains in the source material. Observed vectors include fake browser update lures and web inject chains, malicious MSI installers built with WiX Toolset 4.0.0.0, EV-signed MSI packages that abuse trust and SmartScreen reputation, HTA/mshta-based MaaS affiliate builds, ClickFix-style phishing pages that trick users into manually executing PowerShell, and trojanized software bundles or bootstrapper installers. Specific execution chains include DLL sideloading via legitimate signed binaries such as iMyFone Feedback Utils.exe with a trojanized Qt5Network.dll, Zoner Photo Studio VoTransmitt.exe with a trojanized sciter32.dll, and installers that unpack intermediate loaders before deploying DeerStealer. One analyzed sample used a GhostPulse loader that concealed the payload in headerless PNG-style IDAT chunks stored in cachedrv.xml, with encrypted configuration in servicetable68.cfg. Another WiX Burn sample disguised as "Antonomasia" by publisher "Cyme" used Bichromate.dll masquerading as Adobe CCMNative.dll to decrypt and execute DeerStealer entirely in memory while displaying a legitimate Active@ Password Changer decoy.
Persistence mechanisms directly mentioned in the content include scheduled tasks, HKCU Run key persistence using the value name AppVTemplate, and persistence established by MSI CustomActions before final payload deployment. Anti-analysis and evasion features described in the content include use of signed or EV-signed binaries and installers, in-memory decryption and execution, DLL sideloading, encrypted configuration and payload containers, self-deletion in HTA-based variants, anti-sandbox checks, and rootkit-like or stealth-oriented capabilities. One report states DeerStealer uses Telegram for execution notifications, and another states stolen data may be staged locally in SQLite tables named ribs_collection and ribs_payload before exfiltration via XOR-encrypted HTTPS POST requests and AES-encrypted ZIP archives through a Cloudflare-backed proxy layer.
Associated threat activity in the content links DeerStealer to multiple financially motivated ecosystems and operators. Proofpoint reported TA2727 delivering DeerStealer to Windows users via fake browser update chains, with TA2726 acting as a traffic distribution service redirecting victims by geography. TAG-150, later named GrayBravo, is reported to have used CastleLoader infrastructure to deliver DeerStealer among other payloads. DeerStealer also appears in ShadowLadder campaign reporting, in ITarian abuse chains following fake browser update lures, and in affiliate-operated MaaS activity including HTA-based builds and Telegram-advertised sales. One report attributes the DeerStealer MaaS ecosystem to sales by @LuciferXfiles on Telegram-based cybercrime forums.
High-confidence indicators and artifacts explicitly mentioned in the content include: MSI RVJVAUQL.msi SHA-256 ee5e941218bcf1285b2640c4b2f8baf3ffa44a73b6894ce871a22cbc24b80600; trojanized Qt5Network.dll SHA-256 73d2b832d07ab4f6f893f915ca35a43359250c659900357642c6af1f9cd5e130; cachedrv.xml SHA-256 fdbc169b439b430b7c4688ec3bc56de604d1eaaed66a7c919225981a654ad2ae; servicetable68.cfg SHA-256 3d8f0ef413fec6f85e335ca089da1f67439dbe1c8f5c01fc001b5c03b58028bd; WiX Burn sample SHA-256 04bb4867d35e77e8e391f3829cf07a542a73815fc8be975a7733790d6e04243c; Bichromate.dll SHA-256 58a6b1fe90145f8ae431d05952d1751e705ae46a81be1c2257f5e1e0ce0292c7; encrypted payload file jri SHA-256 d704f5f01487ca3340454240868515de1a43a1b65e5b4a97a74ab409c8441f82; config file yodpxub SHA-256 1a5991a30e9d339cbb0143d4bd134509cf4effc7fead7f4f7dcc059990efd669; active or associated C2 domains telluricaphelion[.]com, loadinnnhr[.]today, nacreousoculus[.]pro, ncloud-servers[.]shop, watchlist-verizon[.]com, 365-drive[.]com; campaign domains statswpmy[.]com and trackingmyadsas[.]com; and ClickFix-delivered MSI SHA-256 ead6b1f0add059261ac56e9453131184bc0ae2869f983b6a41a1abb167edf151 with precursor batch file cv.bat SHA-256 2b74674587a65cfc9c2c47865ca8128b4f7e47142bd4f53ed6f3cb5cf37f7a6b.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Groups like TA2727 use similar JavaScript injects and lures to distribute their own malware, including information stealers like Lumma and DeerStealer.
A WiX Burn installer calling itself "Antonomasia" by "Cyme" bundles a fully functional copy of Active@ Password Changer alongside DeerStealer -- a MaaS infostealer that will drain your browser credentials, crypto wallets, and messaging sessions before you finish clicking through the setup wizard.
Techniques & procedures
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
Persistence
3 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
7 techniques
Stealth
T1027 Defense Evasion Obfuscated Files or Information XOR-encrypted config, AES-encrypted payload
The MSI installed and executed the legitimate and signed application “Rene.E Facebook Widget”. However, one of the bundled DLLs was trojanized with DOILoader, which was side loaded upon execution.
MITRE ATT&CK Technique ID Masquerading: Invalid Code Signature T1036.001 Legitimate signature on malicious payload
T1036.005 Defense Evasion Masquerading: Match Legitimate Name "Antonomasia" by "Cyme" + Active@ Password Changer decoy
T1140 Defense Evasion Deobfuscate/Decode Files or Information In-memory decryption via CryptoPP
Credential Access
4 techniques
Credential Access
Discovery
2 techniques
Discovery
Collection
5 techniques
Collection
T1005 Collection Data from Local System Documents, credentials, wallet files
T1074.001 Collection Data Staged: Local Data Staging SQLite databases (ribs_collection, ribs_payload)
Command and Control
5 techniques
Command and Control
IOCs tracked for this family
53 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information stealer distributed by copycat actors using similar fake-update JavaScript lures.
An infostealer delivered as a secondary payload following ITarian abuse. It is used to steal information after persistence and DLL sideloading activity.
A secondary payload delivered by CastleLoader.
DeerStealer is a malware-as-a-service infostealer delivered here via a malicious WiX Burn installer. It decrypts and executes in memory, steals credentials from 50+ browsers, targets 14+ crypto wallets and 800+ browser extensions, captures messaging sessions, runs a hidden VNC server, logs keystrokes, establishes persistence via a Run key and scheduled tasks, and exfiltrates stolen data over encrypted HTTPS channels.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.