Warning Against Infostealer Disguised as Installer

AhnLab describes an active mass-distribution campaign of the StealC infostealer masquerading as installers or cracked software, delivered via platforms like Discord, GitHub, Dropbox and Mega. The malware downloads a PNG with embedded payload data, reconstructs and executes shellcode that loads an AutoIt process, and uses advanced evasion techniques (filename checks, manual ntdll mapping, Heaven’s Gate, process injection). The report includes multiple MD5 hashes, C2 IPs/URLs, ties to Vidar-like samples sharing infrastructure, and recommends avoiding execution of untrusted installers and verifying official download sources.