MalwarePublished 20 Sep 2025Updated 20 Oct 2025

DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities

Source AlienVault OTX General

Description

DeerStealer is a sophisticated information-stealing malware that targets a wide range of user and system data. It employs deception techniques, persistence mechanisms, and rootkit-like capabilities to evade detection and maintain stealth on compromised systems. The malware uses signed executables, legitimate DLLs, and multi-stage execution to perform its malicious activities. It establishes persistence through scheduled tasks and employs auto-elevated COM objects to bypass User Account Control. DeerStealer's adaptive design allows it to switch C2 servers and use obfuscated files for effective data exfiltration. The malware is actively sold and supported through dark-web forums and Telegram channels, posing a significant threat to both individuals and organizations.

Impact

For European organizations, DeerStealer represents a medium-severity threat with potentially significant consequences. The malware's ability to steal a wide range of user and system data can lead to breaches of confidentiality, including theft of personal data, intellectual property, credentials, and financial information. This is particularly critical given the stringent data protection regulations in Europe, such as GDPR, where data breaches can result in substantial fines and reputational damage. The rootkit-like stealth and persistence mechanisms complicate detection and remediation, potentially allowing prolonged unauthorized access and data exfiltration. The UAC bypass capability increases the risk of privilege escalation, enabling attackers to execute further malicious actions with elevated rights. The adaptive C2 infrastructure makes network-based detection and blocking more challenging, increasing the likelihood of successful data exfiltration. European organizations with high-value targets, such as financial institutions, healthcare providers, and critical infrastructure operators, may face increased risks of operational disruption and financial loss. Additionally, the active sale and support of DeerStealer on underground forums lower the barrier for less sophisticated attackers to deploy this malware, broadening the threat landscape across Europe.

Defensive guidance

To mitigate DeerStealer effectively, European organizations should implement a multi-layered defense strategy tailored to the malware's advanced techniques. First, deploy endpoint detection and response (EDR) solutions capable of behavioral analysis to identify multi-stage execution patterns and rootkit-like activities. Regularly update and validate digital signatures of executables and DLLs to detect unauthorized or suspicious signed files. Monitor and audit scheduled tasks and auto-elevated COM object registrations to detect unauthorized persistence mechanisms and UAC bypass attempts. Network defenses should include DNS filtering and blocking of known malicious domains and IP addresses associated with DeerStealer's C2 infrastructure, such as 'loadinnnhr.today', 'nacreousoculus.pro', and 'telluricaphelion.com', and IP 103.246.144.118. Employ threat intelligence feeds to update detection rules with the provided file hashes and indicators of compromise. Conduct regular user awareness training focusing on phishing and social engineering tactics that may deliver the initial infection vector. Implement strict application whitelisting and least privilege principles to limit the execution of unauthorized software and reduce the impact of privilege escalation. Finally, establish robust incident response procedures to quickly isolate and remediate infected systems, including forensic analysis to understand the scope of compromise and prevent re-infection.

Indicators of compromise

Domains 3

loadinnnhr.today
nacreousoculus.pro
telluricaphelion.com

IP addresses 1

103.246.144.118

Hashes 21

196691384955781b831c331f743443a9
2c7bdaebb9e6614d38d5f1a253c24c7d
4bb605fe8c29a3b05ef7268ec047da56
810d42177538ad5ca18d4dd597c00658
dc84854e5dafee023632c2a2098be54c
366395d6fc13b4cc84e932fb4767fca903479a1d
41cfaac7840d0bcfeb3d6460891b2d4c5254265f
7374bbe63c44de9536c22cdc111894c6d4929eb3
f8067f9807edbba1518537209b457f271a7a342b
0feaaabe6d0a2e29b636cf1f5f9d1b3f727518507ffc93fc881d64feefa2ab81

Community reviews

Loading reviews…