Loading malware…
Stealit is a malware-as-a-service information-stealing malware family targeting Microsoft Windows, with advertised support for Android in its criminal offering. It has been distributed through fake installers for games and VPN software shared via file-hosting and chat platforms. Recent campaigns have used Node.js Single Executable Application packaging, and some variants have also used Electron, to embed heavily obfuscated JavaScript-based payloads inside standalone executables.
Stealit employs layered in-memory execution and extensive anti-analysis checks, including virtual environment detection, timing checks, process and parent-process inspection, and other environment validation intended to frustrate sandboxing and reverse engineering. After execution, it downloads additional components, stores them in user-local application data directories, attempts to weaken endpoint protections by adding Microsoft Defender exclusions, and establishes persistence through a startup script executed at logon.
Its modular payloads are designed primarily for data theft. Observed components extract information from Chromium-based browsers and target browser data, credentials, and cryptocurrency-wallet-related data, as well as data from gaming and desktop applications. Stealit has also been associated with functionality to terminate selected processes before collection, likely to unlock files or improve theft success.
Beyond infostealing, Stealit includes remote-access capabilities commonly associated with RATs, including live screen viewing, webcam access, command execution, file grabbing, payload execution, and victim interaction features. Reported operator-controlled functionality also includes ransomware deployment, making the family broader than a simple stealer. The malware has been marketed through a web panel and Telegram presence as a subscription service for criminal customers.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
To prevent Windows Defender from scanning the downloaded files, all the created directories are added to the exemption list by executing the following PowerShell command: powershell -Command "Add-MpPreference -ExclusionPath {directory}'
All of Node.js’s scripts bundled in the executables are heavily obfuscated to complicate analysis.
the intention is to run the wmic process command... It retrieves the parent process information by running the following command: wmic process where ProcessId={malware process ID} get Name,CommandLine,ExecutablePath /format:csv
If enabled, it performs various checks to detect if it’s running in an analysis environment... Virtual Environment – checks if it’s running under a virtual machine
Registry Analysis – Checks if any of the following registry locations contain data related to debugger applications... DLL Injection... Parent Process – Checks if the process information of its parent process contains one of the blacklisted keywords related to analysis applications
It initially connects to the C2 by sending the following victim information via an HTTP POST request... {"pcName":"[ username ]","hwid":"[ UUID ]","key":"[ 12-character key ]"}
Network Ports - Runs netstat –an to list all active and listening ports in the system.
the intention is to run the wmic process command with the get Name, ProcessId, ExecutablePath, CommandLine /format:csv option to list all running processes
It initially connects to the C2 by sending the following victim information... Username - HWID (Hardware ID) - Key
File Grabber Collect files from Desktop, Documents, Downloads, and other critical paths
If enabled, it performs various checks to detect if it’s running in an analysis environment... Virtual Environment – checks if it’s running under a virtual machine
Registry Analysis – Checks if any of the following registry locations contain data related to debugger applications... DLL Injection... Parent Process – Checks if the process information of its parent process contains one of the blacklisted keywords related to analysis applications
it also extracts information from a variety of applications, including: Game-related Steam Minecraft... Cryptocurrency wallets
ScreenCapture_1.3.2.bat , app.manifest: These files are used to build a VB.NET application screenCapture_1.3.2.exe inside the victim system. It can be used to remotely view the victim’s screen.
It initially connects to the C2 by sending the following victim information via an HTTP POST request to https[:]//root[.]iloveanimals[.]shop/panelping in JSON format
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Stealit is an information stealer malware distributed via fake installers for games and VPNs, often hosted on platforms like Mediafire and Discord.
Stealer/RAT sold as a subscription service that uses Node.js SEA/Electron-based, heavily obfuscated installers to deploy components for credential and data theft (including crypto wallets), remote control (screen/webcam), command execution, persistence, and optional ransomware delivery.
Stealit is an information stealer malware that abuses Node.js single executable applications to exfiltrate sensitive data from infected systems.
A malware-as-a-service stealer with remote access capabilities. It is distributed via disguised installers, uses heavy obfuscation and anti-analysis checks, downloads multiple components, steals browser/application/cryptowallet data, persists via startup VBS, communicates with a C2 panel, and can execute remote commands, screen/webcam monitoring, file grabbing, and ransomware deployment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.