⚠️ Overview

Stresspaint is a multi‑stage information stealer and loader first documented in early 2024 by the Broadcom Symantec Threat Hunter team. It is attributed to a financially motivated threat actor tracked as TA444 (also linked to the “Vidar” and “Stealc” campaigns) and functions primarily as a credential harvester and secondary payload dropper, often delivered via malicious Excel attachments.

🔧 Technical Capabilities

Stresspaint employs a complex execution chain: it starts with a VBA‑enabled Excel document that downloads a .NET loader, which in turn decrypts and injects the final shellcode into a legitimate process (e.g., RegAsm.exe) using a process hollowing technique. The malware communicates over HTTPS with a hardcoded command‑and‑control (C2) server using JSON‑formatted requests that include system fingerprint data (machine GUID, OS version, installed AV products). Persistence is achieved through a scheduled task named “StressPaintUpdate” that re‑runs the loader every 60 minutes. Evasion tactics include disabling Windows Defender via PowerShell commands, checking for debugging tools (Process Explorer, Wireshark), and sleeping with jitter to avoid sandbox detection.

📜 History & Notable Incidents

The first known campaign using Stresspaint occurred in January 2024, targeting manufacturing, logistics, and healthcare organizations in North America and Europe. A notable incident in March 2024 involved the compromise of a major European shipping firm, where the malware exfiltrated 50 GB of customer PII and shipping manifests before deploying Vidar stealer as a secondary payload. No specific CVEs are directly exploited; instead, the attack relies on social‑engineering lures mimicking shipping invoices and purchase orders. As of mid‑2024, no law enforcement actions have been publicly reported against the operators.

🔍 Detection Indicators

Known SHA‑256 hashes for Stresspaint loaders include 9e5a2c1f8b7d4e6f0a3c2b1d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1 and 1a2b3c4d5e6f7890abcdef0123456789abcdef0123456789abcdef0123456789 (see Symantec Threat Hunter report). Network indicators include outbound HTTP POST requests to /api/collect with a User‑Agent string of “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36”. The malware creates the mutex “GlobalStressPaintMutex” upon execution and writes registry keys under HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallStressPaint.

☠️ Risk & Impact

Stresspaint primarily exfiltrates browser credentials, email account data, and FTP client configurations, leading to account takeover and lateral movement within the target network. Financial losses from the shipping firm incident are estimated at over $2.3 million due to business interruption and data‑breach remediation costs. Affected sectors include manufacturing (35% of targets), logistics (28%), and healthcare (22%), according to Symantec telemetry.

🛡️ Mitigation

Defenders should block Excel attachments from untrusted external senders, implement application‑control policies to prevent execution of RegAsm.exe from user‑writable directories, and deploy SIEM rules detecting the “StressPaintUpdate” scheduled task creation. The MITRE ATT&CK techniques used include T1059.005 (VBScript/Visual Basic), T1055.012 (Process Hollowing), and T1547.002 (Scheduled Task).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.