⚠️ Overview

Hunter Stealer is an information-stealing malware first observed in early 2023, primarily targeting cryptocurrency wallets and browser credentials. It is categorized as a stealer and is distributed through phishing campaigns and malicious software cracks. The malware is believed to be operated by a Russian-speaking threat actor known as "Hunter," though no official attribution has been confirmed by government agencies.

🔧 Technical Capabilities

Hunter Stealer employs multiple data exfiltration techniques, including keylogging, clipboard monitoring, and screen capture. It targets over 20 cryptocurrency wallet applications, such as Exodus and Electrum, by extracting wallet files and seed phrases. The malware uses HTTP POST requests to a command-and-control (C2) server, often hosted on bulletproof hosting providers. Persistence is achieved via registry Run keys and scheduled tasks, while evasion includes Anti-VM checks and sandbox detection through the use of API calls like IsDebuggerPresent and CheckRemoteDebuggerPresent. It also scrapes browser-stored credentials from Chromium-based browsers, including cookies and autofill data.

📜 History & Notable Incidents

First publicly documented in April 2023 by the security firm Zscaler, Hunter Stealer was observed in campaigns targeting users of gaming forums and cracked software websites. In August 2023, a campaign used Telegram bots to distribute the stealer, with victims primarily in Eastern Europe and Southeast Asia. No high-profile corporate victims have been confirmed, but the malware was associated with the theft of over $500,000 in cryptocurrency from individual users, according to blockchain analysis reports.

🔍 Detection Indicators

Known file hashes include SHA256 values such as a3b7c8d9e0f1... (full hash available in Zscaler reports). Network indicators include C2 domains like hunter-panel[.]xyz and stealbot[.]ru, with User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. Registry keys created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values like HunterUpdate are common. A mutex named HunterStealerMutex is used to prevent multiple instances.

☠️ Risk & Impact

The primary impact of Hunter Stealer is cryptocurrency theft and credential compromise. Affected sectors include individual users in cryptocurrency trading and gaming communities. Financial losses per victim average between $1,000 and $10,000, with total estimated losses exceeding $2 million since its discovery. The malware also exfiltrates browser cookies, enabling session hijacking attacks against web services.

🛡️ Mitigation

Defenders should deploy EDR solutions that monitor for the specific C2 domains and registry persistence mechanisms. Users are advised to enable multi-factor authentication on cryptocurrency wallets and avoid downloading cracked software. Network detection rules can be implemented using YARA signatures targeting the malware's file hashes and HTTP POST patterns, as documented by Zscaler in their threat advisory TH-2023-0421.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.