⚠️ Overview

Easy Stealer is a commodity information-stealing malware first documented in June 2022 by cybersecurity firm Cyble, categorized as a stealer designed to exfiltrate browser credentials, cryptocurrency wallets, and system data. It is marketed on Russian-language underground forums and operated by threat actors under the alias "EasyStealerDev," with no known nation-state attribution.

🔧 Technical Capabilities

Easy Stealer targets Chromium-based browsers (Chrome, Edge, Brave) and Firefox to harvest saved passwords, cookies, and autofill data, employing a config.json file to specify targets. It also steals cryptocurrency wallet files from extensions like MetaMask and Coinbase Wallet, and collects system information (OS version, CPU, GPU, installed software) via WMI queries. The malware uses HTTP POST requests to a hardcoded C2 server—commonly hosted on bulletproof hosting services—and exfiltrates data as a JSON-encoded blob. Persistence is achieved by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checking for virtual machine or debugger presence (e.g., Sandboxie artifacts) and delaying execution to bypass sandbox timeouts.

📜 History & Notable Incidents

First observed in June 2022, Easy Stealer was primarily distributed through phishing emails containing weaponized Excel or PDF attachments (CVE-2021-40444 exploitation in early campaigns) and fake software cracks on warez sites. In August 2022, Cyble reported a campaign targeting cryptocurrency users in Southeast Asia, with over 500 samples detected in a single month. No high-profile victim disclosures or law enforcement actions have been documented as of early 2025.

🔍 Detection Indicators

Known SHA256 hashes include a3f5c2d1e4b8... (from Cyble's June 2022 report), with behavioral signatures including creation of %TEMP%EasyStealer folder and outbound HTTP connections to IP addresses in the 185.234.72.0/24 range. Registry persistence key: HKCU...RunEasyUpdater. Mutex name "GlobalEasyStealerMutex" is a common indicator, and User-Agent strings mimic legitimate Chrome versions (e.g., "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36").

☠️ Risk & Impact

Easy Stealer causes credential theft and cryptocurrency wallet compromise, leading to account takeovers and financial losses primarily affecting individual users and small businesses in the cryptocurrency and e-commerce sectors. Cyble’s 2022 report estimated that stolen credentials were sold on dark web markets for $50–$150 per bundle, with cumulative losses likely exceeding $2 million based on observed infection volumes.

🛡️ Mitigation

Defensive measures include enabling multi-factor authentication, deploying endpoint detection rules for the mutex and registry key via EDR tools (e.g., CrowdStrike), and blocking outbound HTTP to known C2 IPs. Cyble recommends updating browsers and disabling macros in Office files to prevent initial infection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.