Vanta Stealer is a Python-based information stealer utilizing PyArmor protection and PyInstaller packaging to complicate defensive analysis. The malware systematically harvests credentials from Chromium-based browsers, communication platforms like Discord and Telegram, gaming applications including Steam, Riot Games, Roblox and Minecraft, cryptocurrency wallets, Mullvad VPN configurations, and sensitive documents. It performs token enrichment by validating stolen Discord credentials against the API to retrieve account details, billing information, Nitro status, and server privileges. The modular architecture downloads dedicated browser extraction utilities at runtime, maintains independence between collection modules, and generates structured inventory reports before consolidating harvested data into ZIP archives. Exfiltration occurs via HTTP POST to attacker-controlled infrastructure with victim metadata. Distribution likely occurs through social engineering campaigns involving phishing emails, trojanized...

Indicators of Compromise

• hash: 3bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62
• hash: 4bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabb
• hash: 5dbddac39fda06acc703c22935fa24e0b4bcdbc26624a1869fe93cd568cdb9fc
• hash: 6f20836eef6496695e5f2a5fd81e7dfb8770df38fb1bf67fcf024c1261352daa
• hash: 09e3ce307b2af3f94a315eba97c094d8d755b3674208cc47ceab3c1630a84ad9
• hash: 026c85b97a6ddac14c9835d0580228c0a82dd82ce12d8d921c2f3067a12bbb7e
• hash: 31f3e50e764a090d2dbf759e6cb5f678c5c6a3a5a96ff3a2069ffda520580e52
• hash: 34a01c2429161a8711adff3495ab1dee4419511c8f45c483f50ac71205f68512
• hash: 44d48b4876cc99f1781877eae9d1e22e99925079a5a8cd0d9022176f5757baaf
• hash: 64d85df47edd0187462786ff290f34b080f909a5dda946fa7e83fa3f40aaa878
• hash: 96cc8dc992e465f5f959c7d1481e3789067a78c83706a3dd7ba5a20eaf32b701
• hash: 467c192e3aeafbac29ab272575bc76545f371a50670fb4a1cf3104dae30622e0
• hash: 785d6372f397470c48faa0a9a525b91cb990d0b3ed4b6452e31d75ed179a409c
• hash: 858fcd9bd05d73d2dcc1496761e2f71fd0bf75fa0ae66eeb7405f788837ec384
• hash: 3349f0cf1d4f294d7d98ee12e0ce03a40740668b50e5e553d843f233a0021d36
• hash: 9339c056663e9f57d4b9d34b339cd85048176b9e7d9a20958b7ba190964acd47
• hash: a71c4149bcb8a77ca755ff235e91b1e774293cf3d653aaa2c41fe943cd0848f1
• hash: aa9268a758b5333d725b4b08350ec35e05b9a86f02d65b83b2d9a51e8859b5cd
• hash: b6a7d57fb37a0d9dab8a9e1a81ac6c228fefa4375611bbdf847a775c66cf96c5