Block StilachiRAT A Sophisticated Malware RAT Targeting 20 Crypto Wallet Extensions to Steal Cryptocurrency

[summercms]

Enhancement idea

• Block StilachiRAT A Sophisticated Malware RAT Targeting 20 Crypto Wallet Extensions to Steal Cryptocurrency.

Description

StilachiRAT is a novel remote access trojan (RAT) discovered by Microsoft Incident Response researchers in November 2024. The malware is designed to evade detection, persist in the target environment, and exfiltrate sensitive data from the infected system.

Key Characteristics of StilachiRAT

• Sophisticated techniques: StilachiRAT uses various methods to steal information from the target system, including credentials stored in the browser, digital wallet information, and system information.
• System reconnaissance: Collects comprehensive system information, including OS details and hardware identifiers.
• Digital wallet targeting: Scans for configuration data of 20 different cryptocurrency wallet extensions for Google Chrome.
• Credential theft: Extracts and decrypts saved credentials from Google Chrome.
• Command-and-control (C2) connectivity: Establishes communication with remote C2 servers using TCP ports 53, 443, or 16000.
• Persistence mechanisms: Achieves persistence through the Windows service control manager (SCM) and uses watchdog threads to ensure self-reinstatement if removed.
• RDP monitoring: Monitors RDP sessions, capturing active window information and impersonating users.
• Clipboard and data collection: Continuously monitors clipboard content, actively searching for sensitive data like passwords and cryptocurrency keys.

Screenshots

n/a

Links

https://www.microsoft.com/en-us/security/blog/2025/03/17/stilachirat-analysis-from-system-reconnaissance-to-cryptocurrency-theft/

IOC

I2P websites

n/a

IPFS websites

n/a

Tor2web websites

n/a

TOR websites

n/a

URL's

n/a

Folders

n/a

Sub-Domains

n/a

Domains

95560.cc

Package Names

n/a

IP's

194.195.89.47

ASN's

n/a

Emails

n/a

Wallet addresses

n/a

Mining pool addresses

n/a