StealC Is Back, and This Time It's a RAT

This story was originally published on HackerNoon at: https://hackernoon.com/stealc-is-back-and-this-time-its-a-rat.
Varonis analyzes Stadia RAT, the StealC successor combining credential theft, hidden desktop access, remote commands, and persistent malware capabilities.
Check more stories related to undefined at: https://hackernoon.com/c/undefined. You can also check exclusive content about #varonis-threat-labs, #windows-credential-theft, #malware-indicators, #sigma-detection-rule, #stealc-infostealer, #stadia-trojan-remote-access, #stadia-rat-malware, #good-company, and more.

This story was written by: @varonis. Learn more about this writer by checking @varonis's about page, and for more stories, please visit hackernoon.com.

Four months after Operation Endgame disrupted StealC, its seller returned with Stadia, a remote access trojan that incorporates StealC code and expands it with hidden desktop control, remote command execution, file management, process control, and an in-memory loader. Varonis Threat Labs analyzed the malware's control panel, binary, command-and-control traffic, persistence mechanisms, and shared code. The research identifies detection opportunities across network traffic, scheduled tasks, Windows Defender exclusions, and suspicious processes, illustrating how quickly malware operations can rebuild after a takedown.