Stealc Infostealer: Reverse Engineering

This Sekoia technical analysis details the Stealc information stealer—an infostealer resembling Vidar and Raccoon—covering its anti-analysis tricks, RC4+base64 string obfuscation, dynamic API resolution, host and environment checks, extensive targeting of browsers/wallets/plugins and file grabber functionality, HTTP-based C2 with base64-encoded POST forms, DLL download/loading for data access, next-stage payload capability (e.g., a Laplas Clipper), trace removal behavior, and provides SHA-256 samples, C2 patterns, and scripts to extract/deobfuscate configuration and strings.