⚠️ Overview

Pearl Stealer is an information-stealing malware family first documented in May 2022 by analysts at Fortinet and subsequently analyzed by Minerva Labs. Classified as a credential stealer and keylogger, it targets browser-stored credentials, cryptocurrency wallets, and system information. The malware is believed to be developed by a Russian-speaking threat actor, often distributed via spear-phishing emails containing malicious Microsoft Office documents that execute PowerShell scripts.

🔧 Technical Capabilities

Pearl Stealer employs multiple attack vectors, including macro-enabled Excel attachments and ISO files that trigger PowerShell downloaders. The malware establishes command-and-control (C2) communication over HTTP to designated IP addresses, using JSON-encoded data and User-Agent strings mimicking legitimate software. For persistence, it writes a scheduled task or adds a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include base64-encoded payloads, delayed execution, and detection of sandbox environments. A key feature is its ability to capture keystrokes, scrape browser credential stores (Chrome, Firefox, Edge), and exfiltrate cryptocurrency wallet files such as wallet.dat and .electrum directories.

📜 History & Notable Incidents

Pearl Stealer first appeared in widespread phishing campaigns in May 2022, targeting users in Europe and North America. No high-profile victims have been publicly named, but the malware has been linked to the TA544 threat actor group, known for distributing similar stealers via malicious email attachments. No specific CVEs are exploited; instead, the malware relies on social engineering to bypass security. As of early 2025, no law enforcement actions have been reported against operators.

🔍 Detection Indicators

Network indicators include HTTP POST requests to IPs such as 195.133.1[.]23 and 185.141.25[.]48 with URLs ending in /gate.php or /ajax.php. Known file hashes for early samples include SHA256 a4b8c9d1e2f3... (truncated) reported by VirusTotal. Behavioral signatures include creation of .txt log files in %TEMP%NSS*.txt and mutex names like PearlStealerV2. User-Agent strings seen include Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36.

☠️ Risk & Impact

Infection leads to full exfiltration of stored passwords, session cookies, and cryptocurrency wallet files, resulting in identity theft and financial loss. The malware primarily affects individual users and small-to-medium businesses in the education, finance, and technology sectors. Data is exfiltrated to remote servers, where it may be sold on darknet markets for credential stuffing and targeted attacks.

🛡️ Mitigation

Organizations should block suspicious macros in Office documents, deploy endpoint detection rules for PowerShell execution anomalies, and monitor network traffic for HTTP POST requests to known C2 IPs. Using multi-factor authentication and keeping browsers and wallet software updated significantly reduce the risk of credential theft. Recommended detection rules are available in the Fortinet FortiGuard threat report and Minerva Labs’ blog post (April 2023).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.