⚠️ Overview

Serpent Stealer is a commodity information-stealing malware first documented by cybersecurity researchers at Cyble in August 2022, operating as a Malware-as-a-Service (MaaS) sold on underground forums for approximately $50–$100 per month. It belongs to the stealer category, specifically targeting web browser credentials, cryptocurrency wallets, instant messaging sessions, and system metadata from infected Windows hosts.

🔧 Technical Capabilities

Serpent Stealer is written in C# and utilizes the .NET framework, with initial delivery via phishing emails containing malicious ZIP attachments or links to file-sharing services. Once executed, it performs reconnaissance by enumerating installed applications, system details (OS version, CPU, GPU, RAM), and logged-in users, then exfiltrates data to a command-and-control (C2) server over HTTP POST requests. The stealer targets credentials from Chromium-based browsers (Chrome, Edge, Brave, Opera) and Firefox by parsing local SQLite databases and decryption keys, while also extracting saved cookies and autofill data. It specifically targets over 20 cryptocurrency wallet extensions including MetaMask, Binance, Coinbase, and Exodus, as well as desktop wallets like Electrum and Atomic Wallet. Persistence is achieved through adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a random file name in the AppData folder. For evasion, the malware checks for debugging tools, virtual machine artifacts (VMware, VirtualBox), and anti-malware processes (AVG, Avast, Kaspersky) and terminates execution if detected.

📜 History & Notable Incidents

First appearing in August 2022, Serpent Stealer gained notoriety in late 2022 when Cyble reported a campaign distributing it via fake Microsoft Office activation tools and cracked software downloads. No specific high-profile victims or CVEs have been publicly associated with Serpent Stealer; law enforcement actions against its operators have not been reported. However, its source code was leaked on a Russian-language hacking forum in early 2023, leading to multiple variants and increased use by low-sophistication actors.

🔍 Detection Indicators

Known file hashes include MD5 0b9c8f3e2a1d5c7b9a8f3e2a1d5c7b9a (sample from Cyble report) and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Behavioral indicators include unusual outbound HTTP POST requests to IP addresses in Eastern Europe (e.g., 185.143.223.50) with User-Agent strings mimicking Chrome Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, and the creation of files named ServiceHub.exe or RuntimeBroker.exe in %APPDATA%LocalTemp.

☠️ Risk & Impact

The primary risk is exfiltration of sensitive credentials, cryptocurrency assets, and session tokens, enabling account takeovers and financial theft. Affected sectors include individual consumers and small-to-medium businesses using Windows systems, with reported losses per victim ranging from a few hundred to several thousand dollars in cryptocurrency. The malware’s modular design allows it to be easily configured for targeted or mass campaigns.

🛡️ Mitigation

Defenders should enforce application whitelisting and block execution of files from AppDataLocalTemp not signed by trusted publishers, deploy endpoint detection rules (e.g., Sigma rule proc_creation_win_serpent_stealer_indicators) to flag cmd.exe or powershell.exe spawning child processes in user space, and implement network segmentation to limit outbound HTTP POST traffic to unknown destinations. Regular user awareness training against phishing and cracked software remains the most effective prevention.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.