Detections

Analysis of StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them

StealC / Amadey Infostealer Memory Injection and Browser Stealing

sigma · generated; parse required before publication

title: StealC / Amadey Infostealer Memory Injection and Browser Stealing
description: Detects Amadey downloader executing StealC infostealer payload targeting
  Chromium browser credentials.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    SourceImage: '*\amadey.exe'
    TargetImage: '*\stealc.exe'
  condition: selection
level: medium
tags: []
references: []

MAL_INFOSTEALER_StealC_Amadey

yara · compile required before publication

rule MAL_INFOSTEALER_StealC_Amadey {
  strings:
    $s1 = "StealC_Browser_Decrypt_Key" ascii wide nocase
    $s2 = "Amadey_Bot_ID_v3" ascii wide nocase
    $s3 = "\\sqlite3_step_WebData_Logins" ascii wide nocase
  condition:
    any of them
}