Malware News StealC Is Back, and This Time It's a RAT (named after a google product that was killed)

[Khushal]

Content source

https://www.varonis.com/blog/stealc-returns

StealC Is Back, and This Time It's a RAT

Four months after Operation Endgame took it down, StealC's seller returns with Stadia, a remote access trojan that shares StealC's code byte for byte.

www.varonis.com

In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on one of the most widely sold infostealers of the last three years.

Four months later, on October 16, the seller behind StealC resurfaced with Stadia. This time it's not a stealer: it's a full remote access trojan. The RAT’s features include hidden desktop control, a live command shell, a file explorer, a process manager and an in-memory loader, with StealC's stealer welded on as one module among six. The actor behind Stadia is working hard to win back original StealC customers: every former StealC customer is offered a free month on the top ($900) tier.

Varonis Threat Labs obtained the build shortly after it was listed, reversed it, and watched its panel operate against a machine of our own. The code inside it is StealC's.

Operation Endgame forced the seller to rebuild its infrastructure and start again with a new name, new servers and a new panel. This blog walks through that rebuild from the inside: the listing, the panel running against a host of our own, the agent's code, and the detections that catch it.

 

[Bot]

Hi Khushal. This is more than a StealC rebrand: Stadia turns a one-shot information stealer into an interactive post-compromise platform. The old grabber is now only one module alongside hidden desktop control, command execution, file/process management and a loader capable of launching additional payloads.

The technical linkage looks strong. Varonis found the same 26,112-byte Chromium App-Bound Encryption helper in Stadia and StealC v3.5 builds, byte for byte. Combined with the seller’s effort to recover former StealC customers, that supports a direct lineage. It is compelling malware-family and operator linkage, though not by itself legal proof of the human operator’s identity.

A few useful detection points from the analysis:

• An executable placed in a random 12-character directory under C:\ProgramData\, often using a legitimate-looking updater or Windows filename.
• A hidden scheduled task running at logon and every 15 minutes.
• If elevated, a Defender exclusion added for the installation directory through Add-MpPreference.
• HTTP POST traffic to the root of a bare IP address, claiming to contain JSON while carrying Base64-encoded encrypted data.
• An unsigned ProgramData process starting Chrome, Edge or Brave suspended and injecting code to obtain protected browser credentials.

Those behaviours are more valuable than blocking the three published IP addresses, because Varonis says the C2 addresses and cryptographic material change between builds. Likewise, filenames such as GoogleUpdate.exe or RuntimeBroker.exe are not malicious by name alone; their location, signature, parent process and associated scheduled task matter.

The comeback also does not mean Operation Endgame was pointless. Europol reports that 326 servers and 142 domains were actioned and millions of stolen credentials recovered. Disruption is not eradication: it destroys infrastructure, exposes victims and imposes rebuilding costs, but source code and experienced operators can survive it.

For any confirmed Stadia execution, I would treat the machine as fully compromised rather than merely “scanned for a stealer”: isolate it, protect accounts from a trusted device, revoke sessions, change exposed passwords and assess browser-stored credentials and wallets. A home user needing individualized cleanup should use MalwareTips’ Malware Removal Assistance team.

And yes, naming the comeback after Google Stadia—another Stadia that did not enjoy a long operational life—is bold branding.

Sources

• StealC Is Back, and This Time It's a RAT
• Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks – Coordinated actions take down criminal infrastructure; over EUR 41 million in cri