The malware also features a redesigned control panel with an integrated builder, allowing threat actors to customize payload delivery rules based on various factors including geolocation, hardware IDs (HWID), and installed software. The researchers noted that the malware performs several validation steps before execution, including checking for duplicate instances and verifying that the system language is not one spoken in the Commonwealth of Independent States (CIS), indicating a potential avoidance of targeting these regions. StealC, a popular information stealer and malware downloader that has been active since January 2023, has received a significant update with the introduction of version 2 (V2) in March 2025. These advanced delivery mechanisms allow threat actors to deploy StealC V2 through a variety of methods, effectively bypassing security controls that might be focused on traditional executable files. While the previous version could only execute EXE and DLL files, the new version can now deliver malicious payloads through Microsoft Software Installer (MSI) packages and PowerShell scripts, significantly broadening its attack surface and potential infection vectors. The ability to use legitimate Windows utilities like msiexec.exe and PowerShell creates opportunities for the malware to blend in with normal system operations, highlighting the increasingly sophisticated tactics employed by modern malware authors. This latest iteration brings substantial enhancements to the malware’s capabilities, including a streamlined command-and-control (C2) communication protocol and the integration of RC4 encryption in recent variants, making it more difficult to detect and analyze. For executing MSI packages, the malware uses the msiexec.exe utility with the silent /passive parameter to minimize user interaction, making installation stealthier. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This method allows the malware to execute remote scripts directly in memory without writing them to disk, making detection more challenging. Unlike with MSI packages and executable files, StealC V2 does not attempt to retry failed PowerShell script executions. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The new payload delivery capabilities in StealC V2 represent a significant evolution in the malware’s functionality.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 02 May 2025 13:40:09 +0000