StealC Is Back, and This Time It's a RAT

Four months after the takedown of StealC in June, the malware's seller released Stadia in October, a full-featured RAT that reuses StealC version 3.5 code verbatim, including the Chromium App-Bound Encryption helper. Stadia provides comprehensive remote administration features such as hidden desktop control, live command shell, file explorer, process manager, and an in-memory loader. The malware communicates over plain HTTP to three hardcoded IP addresses, employing RC4 encryption combined with Base64 encoding. Persistence is achieved via hidden scheduled tasks located under C:\ProgramData\ in randomized directories designed to impersonate legitimate software updaters. The operator markets Stadia by offering a free month to former StealC customers on a $900 monthly subscription. Indicators include multiple IP addresses, domain names, and file hashes. There is no vendor advisory or patch information available.

Stadia enables attackers to gain persistent, remote control over infected systems, allowing them to execute commands, manage files and processes, and load code in memory stealthily. This represents a significant escalation from the original StealC infostealer, increasing the potential for espionage, data exfiltration, and system manipulation. The use of plain HTTP communication and RC4 encryption may expose some network traffic to interception, but the malware's persistence mechanisms and remote control features pose a medium-level threat to affected systems.

No official patches or vendor advisories are available for this malware. Defenders should rely on detection and removal using updated endpoint protection solutions and network monitoring for the identified indicators such as the hardcoded IP addresses and domain names. Because the malware uses scheduled tasks for persistence, auditing and removing suspicious scheduled tasks in C:\ProgramData\ with randomized names is recommended. There is no indication that the malware is mitigated or neutralized by any existing fix.