SantaStealer Malware Steals Sensitive Files, Credentials, and Crypto Wallet Data

Cybersecurity researchers at Rapid7 Labs have identified a new threat: SantaStealer, a malware-as-a-service information stealer promoted on various platforms. This malware, rebranded from "BluelineStealer," targets sensitive data and operates entirely in memory to evade detection.

SantaStealer is engineered to exfiltrate a wide range of sensitive information, including documents, credentials, cryptocurrency wallets, and data from numerous applications. The data is compressed, divided into 10 MB chunks, and transmitted to command-and-control servers via unencrypted HTTP connections. The malware is advertised as "fully written in C" with a "custom C polymorphic engine" that claims to be "fully undetected."

The malware features a modular, multi-threaded design with 14 specialized modules. These include modules for reading environment variables, taking screenshots, and targeting applications such as Telegram desktop, Discord, Steam, browser extensions, browsing histories, and passwords. For Chromium-based browsers, SantaStealer uses techniques to bypass AppBound Encryption by embedding an executable based on the ChromElevator project.

The malware uses libraries such as cJSON for JSON parsing, miniz as a zlib-replacement library, and sqlite3 for interfacing with SQLite databases. Anti-analysis features include checks for blocked processes, suspicious computer names, and environment directories, along with system uptime verification and debugger detection.

SantaStealer includes an optional check for Commonwealth of Independent States (CIS) countries, detecting Russian keyboard layouts using the GetKeyboardLayoutList API and terminating execution if configured to avoid CIS targets.

The operators of SantaStealer offer an affiliate program via a web panel, providing access to feature lists, pricing models, and build configuration options. The basic variant is priced at $175 per month, while the premium variant costs $300 per month.

The malware operators claim capabilities such as anti-analysis techniques, antivirus bypasses, and deployment in government and corporate networks. Despite these claims, Rapid7's analysis reveals operational security shortcomings, with leaked samples containing unobfuscated code and unencrypted strings.

To mitigate the risk of SantaStealer infections, users should be cautious with unrecognized links and email attachments, avoid executing unverified code, and refrain from engaging with suspicious prompts. Organizations should ensure endpoint detection systems are updated to recognize indicators of compromise associated with this threat.

Based on reporting by GBHackers.