---
title: StealC Evolves
description: StealC V2, a sophisticated evolution of the StealC information stealer, introduces enhanced payload delivery, RC4 encryption, and a redesigned control panel, posing significant risks to organizations.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [StealC Evolves](https://blog.polyswarm.io/stealc-evolves)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | May 12, 2025 7:01:20 PM

**Related Families:** Amadey

## **Executive Summary**

## StealC V2, a sophisticated evolution of the StealC information stealer, introduces enhanced payload delivery, RC4 encryption, and a redesigned control panel, posing significant risks to organizations.

**Key Takeaways**

- StealC V2 employs RC4 encryption for command-and-control (C2) communications, enhancing its evasion capabilities.
- The malware supports diverse payload delivery methods, including MSI packages and PowerShell scripts.
- A new control panel allows operators to tailor payloads based on geolocation, hardware IDs, and installed software.
- StealC V2 is frequently deployed alongside the Amadey malware loader, amplifying its distribution.

**What is StealC V2?** 

## StealC, an information stealer and malware downloader first identified in January 2023, has undergone a significant transformation with the release of version 2 in March 2025. Zscaler’s ThreatLabz has [tracked](https://www.zscaler.com/blogs/security-research/i-stealc-you-tracking-rapid-changes-stealc) these changes, revealing a malware strain that has bolstered its stealth, flexibility, and data theft capabilities. Written in C++, StealC V2 leverages advanced obfuscation and encryption to evade detection, making it a formidable threat.

The updated StealC V2 introduces a streamlined command-and-control (C2) communication protocol, now fortified with RC4 encryption in its latest iterations. This encryption, initially commented out in early V2 releases, secures network communications and complicates interception efforts. The malware employs a two-stage string deobfuscation process, with critical strings decrypted using a hardcoded RC4 key during execution. This, combined with Themida packing—a commercial code protection tool—hinders reverse engineering, a tactic consistent with StealC V1 but refined in V2.

Payload delivery has been significantly enhanced, offering operators flexibility through executable files (EXE), Microsoft Software Installer (MSI) packages, and PowerShell scripts. These options enable tailored attack chains, with payloads compiled for 64-bit systems and featuring dynamic API resolution to further obscure malicious activities. A self-deletion routine adds to its evasiveness, reducing forensic footprints. The redesigned control panel is a standout feature, integrating an embedded builder that allows operators to customize payload delivery based on geolocation, hardware IDs, and installed software. This granularity enables precise targeting, increasing the malware’s effectiveness.

StealC V2’s data theft capabilities have also expanded. It now supports multi-monitor screenshot capture, a unified file grabber, and server-side brute-forcing for credential extraction. Additional features include Telegram bot integration for real-time operator alerts and the ability to bypass Chrome’s App-Bound Encryption for cookie theft, facilitating Google account hijacking. The control panel supports sophisticated filtering, allowing operators to block communications based on IP addresses, IP masks, or HWIDs, with automated IP blocking after communication completion. Early versions employed a fake 404 error page to evade C2 server detection, though this was patched after researchers identified it as a detection vector.

Frequently deployed via the Amadey malware loader, StealC V2 has been observed in large-scale malvertising campaigns and attacks exploiting browser vulnerabilities. Its modular design and rapid updates, evidenced by minor releases up to version 2.2.4, demonstrate active development and adaptability. PolySwarm analysts consider StealC V2 to be an evolving threat.

**IOCs**

**StealC V2**

PolySwarm has multiple samples of StealC V2.

 

[0b921636568ee3e1f8ce71ff9c931da5675089ba796b65a6b212440425d63c8c](https://polyswarm.network/scan/results/file/0b921636568ee3e1f8ce71ff9c931da5675089ba796b65a6b212440425d63c8c) 

[e205646761f59f23d5c8a8483f8a03a313d3b435b302d3a37061840b5cc084c3](https://polyswarm.network/scan/results/file/e205646761f59f23d5c8a8483f8a03a313d3b435b302d3a37061840b5cc084c3) 

[a1b2aecdd1b37e0c7836f5c254398250363ea74013700d9a812c98269752f385](https://polyswarm.network/scan/results/file/a1b2aecdd1b37e0c7836f5c254398250363ea74013700d9a812c98269752f385) 

[27c77167584ce803317eab2eb5db5963e9dfa86450237195f5723185361510dc](https://polyswarm.network/scan/results/file/27c77167584ce803317eab2eb5db5963e9dfa86450237195f5723185361510dc) 

 

You can use the following CLI command to search for all StealC V2 samples in our portal:

**$ polyswarm link list -f StealCV2**

 

**Amadey**

PolySwarm has multiple samples of Amadey.

 

[dd36c7d50cb05761391a7f65932193ec847d34f8ba1bb2f2a43ecf4985d911f4](https://polyswarm.network/scan/results/file/dd36c7d50cb05761391a7f65932193ec847d34f8ba1bb2f2a43ecf4985d911f4) 

[87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f ](https://polyswarm.network/scan/results/file/87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f)

 

You can use the following CLI command to search for all Amadey samples in our portal:

**$ polyswarm link list -f Amadey**

 

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) ***|* **[Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

 

[View full post](https://blog.polyswarm.io/stealc-evolves)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2025-05-16T17:27:45.328Z",
  "datePublished" : "2025-05-12T19:01:20Z",
  "headline" : "StealC Evolves",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/StealC.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/stealc-evolves",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```