Varonis says the seller behind StealC, which Operation Endgame took down in June, began selling Stadia on Oct 16. It is a remote access trojan with hidden VNC, a remote shell, a file explorer, a process manager, an in-memory loader and a stealer module whose Chromium key helper is byte-for-byte identical to StealC 3.5. Pricing runs $300 to $900 a month, and former StealC customers get a free Pro month.

Host signals

• An unsigned EXE in a random 12-character folder under C:\ProgramData\, named like an updater: RuntimeBroker, SecurityHealthHost, SearchHost, TextInputHost, MicrosoftEdgeUpdate, GoogleUpdate, OneDriveStandaloneUpdater, nvcontainer or AdobeARM.
• A hidden scheduled task registered via COM (so rules keyed on schtasks.exe miss it) with PT15M / P3650D. Varonis gives a Sigma rule on Security events 4698/4702 matching Interval PT15M, Duration P3650D, Hidden true and a ProgramData path.
• When elevated, it runs Add-MpPreference -ExclusionPath for its folder.
• Chrome, Edge or Brave is started suspended and receives about 26 KB of injected code. Moments later a GUID-named .txt holding 64 hex characters appears in ProgramData and is deleted.
• It exits on Russian, Ukrainian, Belarusian, Kazakh and Uzbek system languages. The mutex is Local\<user>.<computer>.

Network: HTTP POSTs to the root path of a bare IP with Content-Type: application/json but a Base64 ciphertext body. The analyzed build used 93.152.213.215, 91.92.43.45 and 193.148.56.97 on port 80. IOCs: SHA-256 ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e (stadia_x32.exe, agent 1.1.2), imphash 028afae8b5e9953e1cd84a003c42fd85, helper blob 0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4, RC4 string key eepkTOgSwdNCgrhITR, marker STADIA_BETA. Varonis didn't establish a delivery method.