⚠️ Overview

Berserk Stealer is an information-stealing malware first documented in mid-2022 by researchers at Cyble Inc., categorized as a commodity stealer that targets credentials, cryptocurrency wallets, and browser data. The malware is believed to be operated by a Russian-speaking threat actor known as "Berserk," who sells the stealer on underground forums and Telegram channels as a malware-as-a-service (MaaS) offering.

🔧 Technical Capabilities

Berserk Stealer is written in C++ and uses DLL sideloading for initial execution, often delivered through phishing emails containing weaponized Office documents or password-protected ZIP archives. Once executed, it enumerates the victim’s system for installed browsers (Chrome, Firefox, Edge, Opera), extracts stored credentials, cookies, and autofill data, and exfiltrates them via HTTP POST requests to a command-and-control (C2) server. The stealer also targets cryptocurrency wallet extensions such as MetaMask, Exodus, and Coinbase, as well as FTP clients like FileZilla, and VPN software including NordVPN and OpenVPN. It employs anti-analysis techniques such as checking for sandbox environments (e.g., Cuckoo, Sandboxie) and terminating itself if virtual machine drivers are detected. Persistence is achieved through a scheduled task or registry run key under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun`. A notable evasion tactic is its ability to disable Windows Defender by modifying registry values via `reg.exe` commands.

📜 History & Notable Incidents

First observed in June 2022 on underground forums selling for $100–$200 per build, Berserk Stealer gained traction in October 2022 when a campaign targeting cryptocurrency users in Eastern Europe was reported by Cyble. No high-profile corporate victims or CVEs have been directly linked to the malware; it primarily infects individual consumers and small businesses. As of early 2025, no known law enforcement action has been taken against the operators.

🔍 Detection Indicators

Known file hashes include SHA256 `a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2` from a Cyble sample, though hashes vary per build. Behavioral indicators include the creation of a mutex named `BerserkStealerMutex` and network traffic to domains like `berserk-stealer[.]xyz` or IP addresses in the 185.xxx.xxx.xxx range commonly used by Russian-hosted VPS. Registry modifications under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun` with a value named `BerserkUpdater` are typical.

☠️ Risk & Impact

The primary risk is credential theft and cryptocurrency asset loss, with affected individuals reporting drained wallets and compromised online accounts. Sectors most impacted include cryptocurrency investors, online gamers with valuable Steam accounts, and users of password managers. Financial losses per victim typically range from a few hundred to several thousand dollars.

🛡️ Mitigation

Defenders should block execution of untrusted macros in Office documents, deploy network intrusion detection rules for the C2 domain patterns, and enable Microsoft Defender’s cloud-delivered protection with periodic scanning. Updated YARA rules from Cyble can detect Berserk Stealer variants; users should also enable multi-factor authentication on all financial and cryptocurrency accounts.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.