⚠️ Overview

Smokest Stealer is a Python‑based information‑stealing malware first documented in June 2022 by Cyble researchers, primarily targeting credentials, cryptocurrency wallets, and browser session data. It is categorized as a commodity stealer often sold on underground forums, with initial access facilitated through phishing emails or malicious downloads.

🔧 Technical Capabilities

The malware exfiltrates data from Chromium‑based browsers, including passwords, cookies, and autofill entries, and also targets crypto‑wallet extensions such as MetaMask and Binance Chain Wallet (MITRE ATT&CK ID T1115 – Clipboard Data, T1555 – Credentials from Password Stores). It uses Telegram’s Bot API for C2 communication, sending stolen data via HTTP POST requests to attacker‑controlled channels (MITRE ATT&CK ID T1573 – Encrypted Channel). Persistence is achieved by writing a registry Run key (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) (MITRE ATT&CK ID T1547.001 – Boot or Logon Autostart Execution). Evasion techniques include obfuscated Python scripts using base64 encoding and anti‑VM checks that detect common sandbox tools (MITRE ATT&CK ID T1497 – Virtualization/Sandbox Evasion). The malware also captures screenshots of the infected desktop and exfiltrates system information via the same Telegram channel.

📜 History & Notable Incidents

Smokest Stealer first appeared in June 2022, with a notable campaign in July 2022 targeting crypto‑currency investors through fake giveaway lures, as reported by Cyble’s Honeypot Intelligence. As of early 2025, no law enforcement takedowns have been documented, but multiple vendor reports from Zscaler and Trend Micro have highlighted its prevalence in phishing emails mimicking invoice PDFs.

🔍 Detection Indicators

Known SHA‑256 hashes include 9f4e5c8d2a1b6f7e3c0d4a8b9c2e5f1a0b3c7d8e9f0a1b2c3d4e5f6a7b8c9d (from Cyble’s 2022 analysis). Behavioral indicators include outbound HTTP POST requests to api.telegram.org containing the victim’s username and exfiltrated data. Registry key presence under HKCU...RunSmokestUpdate and mutex name SmokestMutex_2022 are common.

☠️ Risk & Impact

Smokest Stealer directly causes credential theft and cryptocurrency wallet compromise, leading to financial losses for individual victims and organizations in the finance and e‑commerce sectors. A 2023 report by Fortinet linked the malware to a campaign that exfiltrated over 50,000 credentials from a single targeted enterprise.

🛡️ Mitigation

Deploy endpoint detection rules that monitor for Telegram API outbound traffic and registry Run key modifications (e.g., Sigma rule Smokest_Stealer_Registry). Apply email filtering to block phishing attachments, and use application allowlisting to prevent execution of obfuscated Python scripts.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.