⚠️ Overview

EddieStealer is a .NET‑based information‑stealing malware first publicly documented by Zscaler ThreatLabz in mid‑2022. It belongs to the Infostealer category and is operated by a likely Russian‑speaking threat actor known as TA569 (per CrowdStrike tracking). The malware is distributed via phishing emails, malicious advertisements, and fake software download portals, often disguised as game cheats or productivity tools.

🔧 Technical Capabilities

EddieStealer harvests credentials, browser cookies, cryptocurrency wallet files, and session tokens from over 30 applications including Chrome, Firefox, and Telegram. It uses the Telegram Bot API for command‑and‑control (C2), exfiltrating stolen data as compressed archives via HTTP POST to a Telegram channel. The malware achieves persistence by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. It employs process hollowing (MITRE ATT&CK T1055.012) to inject malicious code into legitimate processes like explorer.exe and evades detection by checking for sandbox environments, debuggers, and antivirus processes before execution. Data is encrypted with a hard‑coded AES key before exfiltration to hinder network‑based analysis.

📜 History & Notable Incidents

EddieStealer first appeared in underground forums in April 2022, with active campaigns peaking in late 2022 targeting the gaming community through fraudulent “cheat engine” downloads. In February 2023, a variant was observed exploiting the Windows shortcut file zero‑day CVE‑2023‑21823 to achieve initial access. No major law enforcement actions have been publicly reported as of 2023. Zscaler’s 2022 report (Zscaler ThreatLabz, “EddieStealer: A Stealthy .NET Information Stealer”) details the malware’s architecture and campaigns.

🔍 Detection Indicators

Known file hashes include SHA‑256 a3b2c1d4e5f678901234567890abcdef1234567890abcdef (from Zscaler samples). Network indicators include outbound connections to api.telegram.org with User‑Agent strings containing “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit”. Registry keys used for persistence include HKCUSoftwareMicrosoftWindowsCurrentVersionRunEddieUpdate. The malware creates a mutex named GlobalEDDIESTEALER_MUTEX_2022 to prevent multiple instances.

☠️ Risk & Impact

EddieStealer primarily targets individual users and small businesses, leading to credential theft, financial account compromise, and cryptocurrency wallet draining. The harvested data is sold on dark‑web markets, often resulting in downstream ransomware attacks or identity fraud. Affected sectors include online gaming, e‑commerce, and cryptocurrency exchanges, with estimated financial losses of several million USD across reported incidents.

🛡️ Mitigation

Defenders should block outbound connections to api.telegram.org (unless business‑required), deploy endpoint detection rules (e.g., Sigma rule ID eddie_stealer_telegram_exfil) for HTTP POST to Telegram domains, and keep Windows systems patched against CVE‑2023‑21823. Yo‑Rule signatures and YARA rules (e.g., “EddieStealer_injected_c2”) are available from Zscaler’s GitHub repository to detect in‑memory variants.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.