TL;DR
- MACROSTEALER (Windows infostealer): Collects browser data, cryptocurrency wallets, cloud storage, and system information. Uses chromeDecryptor.dll and needMe.exe via named pipes, encrypts data with AES-256 and sends it to C2. Detected by the mutex Global\ItsMeRavenOnYourMachine.
- STARSTEALER (Windows/.NET stealer): .NET stealer distributed via public repositories. Utilizes a unique mutex pattern, Star_west_[a-z0-9]{6,9}, transmits encrypted JSON to C2.
- CHRYSALIS (Windows backdoor): Custom backdoor for supply-chain attacks. Loads malicious DLL through a renamed BluetoothService.exe.
- LUTUSLITE (Windows backdoor): Targeted backdoor delivered via spear-phishing ZIP archives. Uses DLL side-loading, registry Run key for persistence, unique mutex Global\Technology360-A@P@T-Team, and creates directory C:\ProgramData\Technology360NB.
1) MACROSTEALER (Windows)
Sample: ANY.RUN
MACROSTEALER is an infostealer that collects data from browsers, local files, cloud storage, cryptocurrency wallets, system information, and installed applications. To bypass browser protections, it uses helper components, including separate DLLs. Collected data is encrypted with AES-256 and exfiltrated to C2 via HTTP POST. The malware employs anti-analysis techniques, terminates security and analysis tools, and uses named pipes for hidden inter-component communication.
How to detect: Identified by the unique mutex Global\ItsMeRavenOnYourMachine.
Key facts:
- Strings in the binary are encrypted and decrypted only at runtime.
- Terminates analysis tools (Wireshark, x64dbg, Process Hacker, etc.).
- Inter-component communication via named pipes.
- Two browser data extraction methods: injection of chromeDecryptor.dll and needMe.exe via named pipes.
- Exfiltration: AES-256 + HTTP POST to hardcoded C2 endpoints.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-06 | News | 2026-02-06 | 2 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
syncObjectName:"ItsMeRavenOnYourMachine"
IOCs:
- SHA256:
cf1aea38924fa5649474e6b9e1d6d855e1716b8cbf86ceda3012b14ad68310e7 - Mutex:
Global\ItsMeRavenOnYourMachine - C2:
107.189.25.189:49259
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1055 | Process Injection | Injects helper DLLs into browser processes. |
| T1555 | Credentials from Password Stores | Steals credentials, cookies, and autofill data from Chromium browsers. |
| T1005 | Data from Local System | Collects files from user directories, cloud folders, and application paths. |
| T1027 | Obfuscated Files or Information | Encrypts stolen data with AES-256 before exfiltration. |
| T1567.002 | Exfiltration Over Web Service | Sends encrypted data to C2 via HTTP POST. |
| T1562.001 | Impair Defenses: Disable or Modify Tools | Terminates security and analysis tools. |
| T1559 | Inter-Process Communication | Uses named pipes for communication between components. |
2) STARSTEALER (Windows)
Sample: ANY.RUN
STARSTEALER is a .NET (C#) infostealer distributed via public repositories and forks. It collects browser credentials, Discord tokens, Telegram sessions, cryptocurrency wallet files, game artifacts, system fingerprint, screenshots, and webcam captures. Data is aggregated locally and sent to a remote endpoint over HTTPS as an encrypted JSON payload.
How to detect: Identified by the mutex pattern Star_west_[a-z0-9]{6,9} and HTTPS POST requests to stealer[.]wtf carrying an encrypted JSON payload.
Key facts:
- Written in C# targeting .NET Framework 4.8.
- Configuration (mutex, C2) is stored encrypted in the binary and decrypted at runtime (AES-GCM).
- Auxiliary requests to ip-api.com and gstatic.com/generate_204.
- Persistence may exist in some variants.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-05 | Tweet | 2026-01-11 | 11 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
syncObjectName:"Star_west_"
IOCs:
- SHA256:
69b1d56c4f954eff0e5eab60e0f7523608476d7a66ae76e75b7ec629a8ba2677 - SHA256:
de4bd49cd245afab4ae04e121af2a0f65211d41e1d5b4b2e46dcac1ef611ce89 - SHA256:
be4f5aeada8628f0ee99eb68582ed6e597daa36c20b4c296300d65b3ec2d6e1a - SHA256:
389612bb973af0707f8ee787660d5d6beb09acad7bf6f35bae0c877defc732f6 - SHA256:
0a4c64cd92ae17962367bd59f4a859a55b8137026de5c27f292a5124a8720ba9 - URL:
https://stealer.wtf/api/upload
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1555.003 | Credentials from Web Browsers | Access to Chromium/Firefox profile databases (Login Data, Cookies). |
| T1071.001 | Application Layer Protocol: Web Protocols | HTTPS-based encrypted exfiltration. |
| T1041 | Exfiltration Over C2 Channel | Transmission of encrypted data via HTTPS POST. |
| T1552.001 | Credentials in Files | Theft of wallet files and local session data. |
| T1078 | Valid Accounts | Theft of Discord tokens and browser credentials. |
3) CHRYSALIS (Windows)
Sample: ANY.RUN
CHRYSALIS is a custom backdoor used in supply-chain attacks.
How to detect: Detected by anomalous file and behavioral activity, specifically the use of a renamed BluetoothService.exe for DLL side-loading of a malicious DLL.
Key facts:
- Uses a renamed Bitdefender tool BluetoothService.exe to load a malicious DLL.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-03 | News | 2026-02-10 | 1 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
filePath:"\\\\Bluetooth\\\\Bluetoothservice.exe$"
IOCs:
- SHA256:
a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9 - SHA256:
3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Modifies autorun value in the registry. |
| T1012 | Query Registry | Checks various registry keys. |
| T1082 | System Information Discovery | Reads the computer name. |
| T1614 | System Location Discovery | Checks system location. |
| T1071 | Application Layer Protocol | Uses application-layer protocols. |
4) LUTUSLITE (Windows)
Sample: ANY.RUN
LUTUSLITE is a targeted Windows backdoor delivered via carefully crafted spear-phishing emails containing ZIP archives. A legitimate loader uses DLL side-loading to execute a malicious DLL. The implant features hard-coded HTTPS C2 communication, basic remote command execution and file operations, and persistence via registry Run keys.
How to detect: Identified by the creation of the directory C:\ProgramData\Technology360NB and the mutex Global\Technology360-A@P@T-Team.
Key facts:
- DLL side-loading via legitimate loader.
- Persistence through Run registry key.
- C2 communication over HTTPS with traffic masking.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-01-26 | News | 2026-02-11 | 6 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
syncObjectName:"Global\\Technology360-A@P@T-Team" and filePath:"C:\\ProgramData\\Technology360NB"
IOCs:
- SHA256:
819f586ca65395bdd191a21e9b4f3281159f9826e4de0e908277518dba809e5b - SHA256:
2c34b47ee7d271326cfff9701377277b05ec4654753b31c89be622e80d225250 - SHA256:
231bac4015da9157553f5a8090bea35b8657406a18f14455fdaa71eb14427466 - SHA256:
ac144cdb3efc61ae58f9ff5f0d9e8f8475e90cec1bca1a3c629959eb3f23deb4
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1566.001 | Phishing: Spearphishing Attachment | Delivery of malicious ZIP archive via targeted emails. |
| T1574.001 | Hijack Execution Flow: DLL Side-Loading | Loads kugou.dll via legitimate loader. |
| T1036.005 | Masquerading: Match Legitimate Name or Location | Imitates legitimate names and locations. |
| T1036.003 | Masquerading: Rename Legitimate Utilities | Renames components to resemble known software. |
| T1059.003 | Command and Scripting Interpreter: Windows Command Shell | Executes cmd.exe on commands received from C2. |
| T1071.001 | Application Layer Protocol: Web Protocols | C2 communication over HTTPS via WinHTTP. |
| T1102.002 | Network Service: Bidirectional Communication | Bidirectional data exchange over standard HTTPS. |
| T1037.001 | Boot or Logon Initialization Scripts: Registry Run Keys | Adds Run key for autostart. |
| T1112 | Modify Registry | Modifies registry for persistence. |
| T1219 | System Binary Proxy Execution | Uses legitimate binary as proxy to execute malicious library. |
Conclusion
MACROSTEALER leaves a distinctive mutex, Global\ItsMeRavenOnYourMachine, which is a reliable detection artifact.
STARSTEALER uses a predictable mutex pattern, Star_west_, and sends encrypted JSON to the known domain stealer.wtf.
CHRYSALIS masquerades as BluetoothService.exe — searching for this renamed file instantly reveals the threat.
LUTUSLITE creates the Technology360NB directory and the mutex Global\Technology360-A@P@T-Team. These two artifacts together provide high-confidence identification.