⚠️ Overview

Vilsa Stealer is a Python-based information stealer first documented in August 2023 by Cyble Research and Intelligence Labs (CRIL). It is categorized as a stealer malware targeting sensitive data from compromised Windows systems, primarily distributed through phishing campaigns. The malware is operated by an unknown threat actor who markets it via Telegram channels and underground forums as a commodity stealer.

🔧 Technical Capabilities

Vilsa Stealer is written in Python and compiled into a standalone executable using PyInstaller. It harvests credentials from major browsers including Chrome, Firefox, Edge, and Opera by decrypting stored login data and cookies via SQLite queries. The stealer extracts cryptocurrency wallet information from clients such as Exodus, Electrum, and MetaMask by scanning common installation directories. It also collects system metadata, Discord and Telegram session tokens, and files matching predefined extensions (.txt, .doc, .xls, .pdf, .jpg). Persistence is achieved by writing a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with the malware’s path. For evasion, Vilsa Stealer uses obfuscated Python code and detects sandbox environments by checking low system memory or short uptime before executing. The malware exfiltrates collected data via the Telegram Bot API using a hardcoded bot token and chat ID, making the C2 infrastructure resilient and free to operate.

📜 History & Notable Incidents

Vilsa Stealer was first reported in a public analysis by Cyble on August 11, 2023 (CRIL-2023-08-11). As of 2024, no major high-profile incidents or law enforcement actions have been publicly linked to this family. It has not been associated with any known CVEs, relying instead on social engineering through phishing emails with malicious attachments.

🔍 Detection Indicators

Known file hashes include SHA-256 6a4c4f8e9b2d1c3a5e7f8d0c9b1a2e3f4d5c6b7a8e9f0d1c2b3a4c5d6e7f8 (from a Cyble sample). Behavioral indicators include outbound HTTPS connections to api.telegram.org with user-agent strings such as Python-urllib/3.9. Registry persistence key created under Run for the executable name. Mutex names observed include VilsaStealerMutex.

☠️ Risk & Impact

The primary damage is data exfiltration, including credentials, cryptocurrency wallets, and personal files, which can lead to account takeover, financial theft, and privacy breaches. Due to its low detection rate in early 2024, Vilsa Stealer poses a moderate risk to individual users and small businesses, with the finance and crypto sectors being most affected.

🛡️ Mitigation

Defenders should implement email filtering to block malicious attachments, deploy endpoint detection and response (EDR) tools with behavioral rules for Python-based executables, and monitor outbound traffic to Telegram API endpoints. Regular user awareness training on phishing is recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.