StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown

StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted infostealer into a platform for persistent endpoint control.

Advertised on October 16, the malware combines credential theft with hidden desktop access, command execution, file management, and payload delivery, according to research supplied by Varonis Threat Labs.

The comeback follows June’s Operation Endgame action against StealC, Amadey and SocGholish.

Europol reported that authorities and private partners actioned 326 servers and 142 domains across the operation, recovering approximately 27 million stolen credentials. Those figures describe the coordinated campaign, not StealC alone.

Their analysis identified StealC code inside the new agent. At the same time, the panel’s changelog explicitly recorded an upgrade to the StealC 3.5.0 stealer module.

Stadia offers six modules: hidden virtual network computing, a stealer, Remote CMD, a loader, File Explorer and Process Manager.

Desktop access supports both the current session and an isolated hidden desktop, allowing operators to interact with compromised systems outside the victim’s visible workspace.

The loader advertises support for EXE, PowerShell, CMD and MSI payloads, with disk or memory execution options.

The stealer targets more than 50 browsers, over 120 cryptocurrency extensions and more than 50 desktop wallets, alongside messaging applications, gaming sessions, email clients and VPN software.

The HVNC screenshot is a live remote-desktop session on an infected Windows 11 machine, with a Spanish-language runtime error dialog sitting on the victim’s desktop. 

Varonis researchers obtained a Stadia build, reverse engineered its executable and observed its management panel communicating with a controlled Windows host.

StealC Malware Resurfaces

Subscriptions cost $300 monthly for Basic, $550 for Team and $900 for Pro. Only Pro includes all six modules. Former StealC customers receive a free Pro month, directly linking the relaunch to the seller’s existing customer base.

The analyzed sample, stadia_x32.exe, is an unsigned, 560,128-byte Windows executable compiled with Microsoft Visual C++.

The builder tab compiles agents from the current published version. Operators create a build, download the .exe, and deploy it. 

The sidebar organizes stolen data by type: passwords, credit cards, messengers, software, session tokens for Chrome, Discord, Steam, Roblox, and Azure, and a crypto section for seed phrases.

It identifies itself as STADIA_BETA, reports version 1.1.2 and imports only KERNEL32.dll, resolving most operational APIs dynamically.

Although unpacked, the binary obscures meaningful strings using RC4 encryption followed by Base64 encoding.

Researchers recovered 542 strings, exposing configuration data, command vocabulary, browser targets and persistence templates.

Before installation, Stadia checks the system language and exits for Russian, Ukrainian, Belarusian, Kazakh and Uzbek locales. Installed agents use a username-and-computername mutex to prevent duplicate execution.

Its configuration contains three command servers: 93.152.213.215, 91.92.43.45 and 193.148.56.97.

Connections use plain HTTP, but message bodies contain Base64-encoded, RC4-encrypted JSON despite declaring an application/json content type. The agent tests servers sequentially and retries after 300 seconds if none responds.

Stadia installs beneath a randomized, 12-character directory in C:ProgramData, adopting filenames such as MicrosoftEdgeUpdate.exe, RuntimeBroker.exe or GoogleUpdate.exe.

A hidden scheduled task launches it at logon and every 15 minutes, with a configured duration of 3,650 days.

When elevated, the agent also invokes PowerShell to add its installation directory to Microsoft Defender exclusions.

This combination makes executable location, task configuration and exclusion changes more useful investigative context than filenames alone.

Defenders investigating suspected infections should correlate these artifacts with connections to the reported infrastructure and inspect unexpected updater binaries under ProgramData.

The sample’s SHA-256 is ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e.

The resurgence illustrates the distinction between infrastructure disruption and developer removal: Stadia preserves StealC’s theft capability while packaging it inside a broader, subscription-based remote intrusion toolkit for criminal operators seeking sustained access to compromised Windows endpoints.

Indicators of compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.