How do you detect StealC stealer?

Detect StealC by behaviour. Alert on helper DLLs such as sqlite3.dll, nss3.dll and mozglue.dll written outside Mozilla or application directories by a process in a user-writable path, which documented earlier builds do to parse browser data. Combine that with non-browser reads of credential and wallet stores, grabber-style sweeps of documents and key files, and a single short-lived HTTP POST session from the same binary. Validate against current builds, rotate credentials on a hit and baseline portable applications that legitimately bundle the same libraries.

Detecting StealC Stealer: TTPs and Host Behaviours

StealC is a C-based infostealer sold on criminal forums since 2023 and distributed through loaders, cracked software and malvertising. It targets browsers, wallets, messaging and other applications, applies a file-grabber configuration pushed from its server, and returns data over HTTP. Public analyses of earlier builds describe it fetching legitimate helper libraries from its server to parse browser data. We rely on those documented behaviours and publish no indicators.

Signals at a Glance

Behaviour	Where	ATT&CK
Helper libraries (sqlite3.dll, nss3.dll, mozglue.dll) written outside a Mozilla or application directory	Sysmon 11, EDR file events	T1105
Browser credential, cookie and extension-wallet stores read by an unsigned process	EDR file access	T1555.003
Server-supplied file-grabber rules matching documents, keys and wallet files	EDR file access	T1005
Staging folder of collected data followed by a single HTTP POST	Sysmon 11/3, proxy	T1041
Short-lived process from a user-writable path with outbound HTTP to an uncommon host	EDR network	T1071.001

Dependency DLL Staging

Browsers and mail clients ship the libraries a stealer needs to decrypt their data, but malware that has no browser installed to borrow them from fetches its own copies. Finding those DLL names outside their normal directories, written by a non-Mozilla process, is a precise signal. Verify the behaviour on current builds, since newer versions may avoid it:

// Microsoft Defender (KQL) - browser helper DLLs dropped outside application directories
DeviceFileEvents
| where ActionType == "FileCreated"
| where FileName in~ ("sqlite3.dll","nss3.dll","mozglue.dll","softokn3.dll","freebl3.dll","vcruntime140.dll","msvcp140.dll")
| where FolderPath !has_any ("\\Mozilla Firefox\\", "\\Mozilla Thunderbird\\", "\\Windows\\", "\\Program Files")
| where InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Temp\\", "\\ProgramData\\", "\\Users\\Public\\")
| summarize dlls=make_set(FileName), first=min(Timestamp) by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FolderPath
| where array_length(dlls) >= 2
// tune/validate: legitimate portable apps bundle these DLLs; allowlist by signed publisher

Network Shape

Once collection ends, the data leaves in one or a few HTTP POSTs to the server. In process-level network telemetry that shows as a binary in a user-writable path with a single short-lived outbound session:

index=sysmon EventCode=3 Initiated=true DestinationPort IN (80,443,8080)
  (Image="*\\AppData\\*" OR Image="*\\Temp\\*" OR Image="*\\ProgramData\\*" OR Image="*\\Users\\Public\\*")
  NOT Image IN ("*\\Microsoft\\*","*\\Google\\*","*\\Zoom\\*","*\\Teams\\*")
| stats count dc(DestinationIp) AS dests earliest(_time) AS first latest(_time) AS last BY host, Image
| where count <= 5 AND dests = 1
| eval duration=last-first
| where duration < 120
`comment("tune/validate: add your sanctioned updaters; enrich DestinationIp with rarity and registration age")`

Pair the DLL-staging hit with the credential-store access detection; the two together are high confidence.
Expect the grabber configuration to differ per operator, so alert on the access pattern rather than a fixed file list.
Remediate by rotating credentials, revoking sessions and reviewing what the grabber could reach on that host.

Vetted sources

Use vendor and CERT analyses of StealC for behaviour, the MITRE ATT&CK software page, and SigmaHQ, Elastic and Splunk ESCU content for credential access and ingress tool transfer. Behaviour changes between versions, so validate each query on current samples in a lab and baseline your environment before alerting.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Dependency DLL Staging

Network Shape

Build Detections That Fire

Infostealer Detection

Detection Hub

Lumma Stealer Detection

Stealer C2 Exfiltration Detection