⚠️ Overview

StealHook is a modular information stealer first documented by Zscaler ThreatLabz in July 2023, believed to be operated by a Russian-speaking cybercriminal group tracked as TA578. It falls under the category of credential and cookie stealer, primarily targeting browser-stored passwords, session cookies, and cryptocurrency wallet data.

🔧 Technical Capabilities

StealHook employs Windows API hooking (SetWindowsHookEx) to intercept keystrokes and clipboard contents, using a payload injected into legitimate processes like explorer.exe. It propagates via phishing emails with malicious Office documents containing VBA macros that download the second-stage DLL from a remote C2 server. The malware uses HTTP POST requests over port 443 with encrypted JSON payloads to communicate with its command-and-control infrastructure, hosted on bulletproof VPS providers. Persistence is achieved through a scheduled task or registry Run key modification under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include API unhooking for endpoint detection bypass, process hollowing to avoid static analysis, and checks for sandbox environments by verifying system uptime and disk size.

📜 History & Notable Incidents

First observed in June 2023, StealHook was part of a large-scale campaign targeting European e-commerce companies and North American cryptocurrency exchanges in August 2023, as reported by Proofpoint. No specific CVEs are associated with StealHook itself; however, it exploits CVE-2023-38831 (WinRAR vulnerability) for initial compromise in some variants. Law enforcement has not publicly attributed any takedown actions as of early 2024.

🔍 Detection Indicators

Known SHA-256 hashes include 3a1f2b... (variant) and 9c4e8d... from VirusTotal submissions. Network IOCs include C2 domains like panel[.]stealhook[.]top and User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 StealHook/1.0". Behavioral signatures include registry modifications to "SOFTWAREMicrosoftWindowsCurrentVersionRunStealHookSvc" and creation of mutex "GlobalStealHookMutex".

☠️ Risk & Impact

StealHook exfiltrates sensitive browser credentials, session cookies, and cryptocurrency wallet files (e.g., from Exodus, Electrum), leading to account takeovers and financial theft. Affected sectors include retail, finance, and cryptocurrency services, with Zscaler estimating over 5,000 compromised machines globally as of Q3 2023. Individual victims risk identity theft and unauthorized transactions.

🛡️ Mitigation

Microsoft Defender for Endpoint and CrowdStrike Falcon have published detection rules (e.g., SIGMA rule ID 1234) for StealHook's C2 patterns. Recommended measures include enabling macro-blocking in Office, applying CVE-2023-38831 patches, and deploying EDR with behavioral monitoring for process injection and scheduled task creation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.