Stadia RAT Revives StealC Operation After Europol Takedown

Summary

Varonis Threat Labs reverse-engineered Stadia, a remote-access trojan from the StealC seller. The sample combines StealC 3.5 credential theft with remote-control modules and uses hidden scheduled-task persistence and encrypted-over-HTTP command traffic.

Key points

Varonis says Stadia appeared four months after Operation Endgame disrupted StealC; the seller offered former StealC customers a free month on Stadia's Pro tier.
The analyzed Stadia sample includes a 26,112-byte Chromium App-Bound Encryption helper identical byte-for-byte to one in StealC v3.5 builds.
Stadia combines StealC credential theft with hidden desktop control, remote command execution, file browsing, process management and disk or in-memory loading.
The agent installs under a randomized folder in C:\ProgramData\, creates a hidden scheduled task that runs every 15 minutes, and can add a Windows Defender exclusion when elevated.
C2 traffic uses HTTP POST requests whose bodies are RC4-encrypted and Base64-encoded despite a Content-Type header claiming JSON.
Varonis recommends hunting for suspicious browser-process injection from unsigned executables in C:\ProgramData\, transient GUID-named text files, and the hidden scheduled-task pattern.

Article Details

Attack Vectors: The Stadia agent installs under a randomized directory in C:\ProgramData\ and uses a filename selected from names that impersonate legitimate updaters.
It establishes persistence with a hidden scheduled task that runs at logon and every 15 minutes.
When elevated, it uses PowerShell Add-MpPreference to add its install directory to the Windows Defender exclusion list.
The agent communicates with hard-coded C2 addresses over HTTP POST. It sends RC4-encrypted, Base64-encoded message bodies while declaring Content-Type: application/json.
The stealer collects browser credentials, cookies, wallet data, and other application data. The analyzed build also injects code into suspended Chrome, Edge, or Brave processes to access browser-protected data.
The RAT provides remote command execution, file browsing and transfer, process management, desktop control, and a loader that can run files from disk or memory.
Defensive Notes: Monitor for unsigned processes running from C:\ProgramData\ that create suspended Chrome, Edge, or Brave processes and write a 26 KB code block into them.
Look for a GUID-named .txt file in C:\ProgramData\ containing a 64-character hexadecimal string that is subsequently deleted.
Hunt for new executables in randomized C:\ProgramData\ folders, hidden scheduled tasks with a 15-minute interval and 3,650-day duration, and Windows Defender exclusions added through PowerShell.
The article says the analyzed build's C2 addresses can be blocked, but notes that these addresses change between builds.
The article recommends starting behavioral rules in alert mode and tuning them against local telemetry before blocking.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`stadiadev[.]cc`	Domain identified in the article as the Stadia operator panel.
IPV4	`193[.]148[.]56[.]97`	Third hard-coded C2 address in the analyzed build's failover order.
IPV4	`91[.]92[.]43[.]45`	Second hard-coded C2 address in the analyzed build's failover order.
IPV4	`93[.]152[.]213[.]215`	Primary hard-coded C2 address used by the analyzed Stadia build.
MD5	`7739a8d0d101ca82b93bbd0acdb6d9af`	MD5 of the analyzed Stadia agent sample.
SHA1	`1ba76d2029744cc6e2f7209c96a696b32962b1f1`	SHA-1 of the analyzed Stadia agent sample.
SHA256	`0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4`	SHA-256 of the App-Bound Encryption helper blob embedded in Stadia and reported as byte-identical to the helper in StealC v3.5 builds.
SHA256	`ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e`	SHA-256 of the analyzed Stadia agent executable, stadia_x32.exe.