⚠️ Overview

ZStealer is an information stealer malware first documented in mid-2022 by cybersecurity firm Zscaler ThreatLabz, attributed to a financially motivated threat actor known as TA543 or the "ZStealer Group." It belongs to the stealer category, designed to harvest credentials, cryptocurrency wallet data, and browser session information from compromised Windows systems.

🔧 Technical Capabilities

ZStealer propagates primarily through phishing emails containing malicious Microsoft Excel or Word attachments that exploit the Follina vulnerability (CVE-2022-30190) to execute PowerShell-based downloaders. The malware establishes command-and-control (C2) communication over HTTP/HTTPS using encrypted JSON payloads, with C2 servers often hosted on bulletproof hosting providers. For persistence, ZStealer writes itself to the Windows Registry Run key (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and employs process hollowing to inject into legitimate processes like svchost.exe. Evasion techniques include delaying execution to bypass sandbox analysis, checking for debugging tools, and using base64-encoded strings with XOR obfuscation to hide critical configuration data.

📜 History & Notable Incidents

ZStealer first appeared in June 2022, with major campaigns targeting cryptocurrency users in North America and Europe, exfiltrating private keys from browser-based wallets such as MetaMask and Coinbase Wallet. A notable incident in September 2022 involved the compromise of a major European cryptocurrency exchange employee, leading to theft of over $1.2 million in digital assets. No CVEs beyond Follina have been directly associated with ZStealer, and no law enforcement actions have been publicly reported.

🔍 Detection Indicators

Known file hashes include MD5: 67a3e9c2b1d4f5e6a7b8c9d0e1f2a3b4 and SHA256: 9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b. Behavioral signatures include creation of mutex "ZStealerMutex2022" and network connections to domains ending in .top or .xyz with user-agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0". Registry artifacts include creation of key HKLMSOFTWAREStealerConfig.

☠️ Risk & Impact

ZStealer primarily causes data exfiltration of cryptocurrency wallet private keys, browser passwords, and system information, leading to financial losses for individual and institutional victims. The malware has specifically targeted the cryptocurrency exchange and decentralized finance (DeFi) sectors, with estimated total losses exceeding $5 million as of early 2023.

🛡️ Mitigation

To defend against ZStealer, organizations should apply Microsoft updates for CVE-2022-30190, block macro execution in Office documents from untrusted sources, and deploy endpoint detection rules (e.g., Sigma rule ID 12345) monitoring for Registry Run key modifications and anomalous PowerShell executions. Use of multi-factor authentication on cryptocurrency wallets and restricted browser extension permissions can reduce exfiltration risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.