New Stealit Malware Attacking Windows Systems Abuses Node.js Extensions
A new malware campaign, termed "Stealit," has been identified targeting Windows systems. This campaign utilizes Node.js Single Executable Application (SEA) features to distribute malicious payloads, effectively bypassing traditional detection mechanisms.
A new malware campaign, termed "Stealit," has been identified targeting Windows systems. This campaign utilizes Node.js Single Executable Application (SEA) features to distribute malicious payloads, effectively bypassing traditional detection mechanisms.
The Stealit malware signifies an advancement in malware-as-a-service, integrating advanced obfuscation methods and extensive anti-analysis capabilities to maintain persistent control over compromised systems.
This campaign distributes disguised installers for popular software, including games and VPN applications, via platforms such as Mediafire and Discord. These malicious packages employ PyInstaller bundling and compressed archives, complicating detection efforts for both users and security solutions .
The operators of Stealit have developed a commercial infrastructure offering subscription pricing models, promotional channels, and customer support services.
Fortinet analysts identified this campaign following an increase in detections of Visual Basic scripts used for persistence mechanisms.
A new malware campaign, termed "Stealit," has been identified targeting Windows systems.
This malware now utilizes Node.js native SEA functionality, moving away from earlier variants that relied on Electron frameworks. This adaptation enables the creation of standalone binaries that function independently of pre-installed Node.js runtimes or additional dependencies.
Stealit demonstrates sophisticated evasion capabilities, employing multiple detection layers designed to target virtual environments, debugging tools, and analysis platforms. These checks analyze system specifications, such as memory allocation, CPU core counts, and hostname patterns, to identify potential research environments.
Technical Implementation and Execution Flow
The Stealit malware utilizes a multi-layered architecture. It begins with an installer component that downloads additional modules from command-and-control servers. The initial payload uses Node.js SEA functionality to embed malicious scripts within seemingly legitimate executable files. The core script is stored as a raw data resource NODE_SEA_BLOB, containing both execution code and original development paths.
The installer includes anti-analysis measures, such as virtual environment detection through system resource verification, timing analysis for mathematical operations, and process enumeration to identify debugging applications. Registry checks are conducted to examine locations like HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug for debugger configurations, while DLL injection analysis reviews loaded modules for analysis-related libraries.
Upon successful environment validation, the malware establishes persistence through multiple mechanisms, including Visual Basic scripts placed in Windows startup folders and PowerShell commands to exclude directories from Windows Defender scanning.
The system downloads three core components: save_data.exe for privileged operations, stats_db.exe for data extraction, and game_cache.exe for command-and-control communication. The save_data component employs ChromElevator-based tools to extract information from Chromium browsers. The stats_db.exe targets various application categories, such as gaming platforms like Steam and Minecraft, messaging services like WhatsApp and Telegram, and cryptocurrency wallets like Atomic and Exodus. The game_cache module manages remote access trojan functionality, including screen capture, webcam access, file manipulation, and command execution capabilities.
Based on reporting by Cyber Security News.