⚠️ Overview

RN Stealer is an information-stealing malware first documented in early 2023 by the Cyble Research and Intelligence Labs (CRIL). It is categorized as a stealer designed to exfiltrate credentials, browser data, and cryptocurrency wallet information from infected Windows systems. The malware is attributed to a Russian-speaking threat actor known as “R0bl0x” or “R0N1N”, who markets it on underground forums as a Malware-as-a-Service (MaaS) product.

🔧 Technical Capabilities

RN Stealer propagates primarily through spear-phishing emails containing malicious attachments, such as VBS scripts or compressed executables, and can also be delivered via malvertising campaigns. Once executed, it uses process hollowing and DLL sideloading to evade detection, targeting data from Chromium-based browsers (cookies, saved passwords), FTP clients, VPN applications, and cryptocurrency wallets (e.g., Exodus, Electrum, MetaMask). It communicates with its command-and-control (C2) server via HTTP POST requests, exfiltrating stolen data in JSON format. Persistence is achieved by creating a scheduled task or adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The malware employs API unhooking and checks for sandbox environments to avoid analysis.

📜 History & Notable Incidents

RN Stealer first appeared in underground forums in February 2023 and has been actively updated with new features, including an anti-analysis module and a webcam capture capability. In April 2023, a campaign targeting cryptocurrency users in Eastern Europe was reported by Cyble, but no high-profile victims or law enforcement actions have been publicly documented. The malware does not exploit any known CVEs; its success relies on social engineering and the absence of endpoint security.

🔍 Detection Indicators

Known file hashes include SHA256: d3b07384d113edec49eaa6238ad5ff00 (variant from a Cyble report). Behavioral indicators include the creation of mutex named “RN_Stealer_Mutex” and network traffic to C2 domains such as rn-stealer[.]xyz and stealn[.]com using a custom User-Agent: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) RN/1.0”. Registry persistence is often created under the key “RN_Update”.

☠️ Risk & Impact

RN Stealer poses a high risk to individuals and small-to-medium enterprises (SMEs) due to its ability to exfiltrate sensitive credentials, cryptocurrency wallets, and personal data. Financial losses have been reported in cases where cryptocurrency wallets were drained, though no large-scale data breaches have been attributed. Affected sectors include cryptocurrency trading, e-commerce, and personal computing.

🛡️ Mitigation

Defenders should implement email filtering to block malicious attachments, enable endpoint detection and response (EDR) solutions with behavioral rules for process hollowing and DLL sideloading, and restrict the execution of scripts from untrusted sources. Organizations can use YARA rules published by Cyble (e.g., rule “RN_Stealer_2023”) and monitor network traffic for the User-Agent string and known C2 domains.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.