---
title: Hunt: StealC's seller is back with Stadia, a RAT with hidden VNC. Look for hidden 15-minute tasks under ProgramData, suspended-browser injection and fake JSON POSTs | ctxsec
url: https://ctxsec.com/items/hunt-varonis-stadia-rat-stealc-successor
description: ""
status: "confirmed research (Varonis Threat Labs, updated Oct 22); C2s and keys are build-specific"
published: 2026-10-22
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-varonis-stadia-rat-stealc-successor.md)

confirmed research (Varonis Threat Labs, updated Oct 22); C2s and keys are build-specific

2026-10-22

### Hunt: StealC's seller is back with Stadia, a RAT with hidden VNC. Look for hidden 15-minute tasks under ProgramData, suspended-browser injection and fake JSON POSTs

Varonis says the seller behind StealC, which Operation Endgame took down in June, began selling **Stadia** on Oct 16. It is a remote access trojan with hidden VNC, a remote shell, a file explorer, a process manager, an in-memory loader and a stealer module whose Chromium key helper is byte-for-byte identical to StealC 3.5. Pricing runs $300 to $900 a month, and former StealC customers get a free Pro month.

**Host signals**

- An unsigned EXE in a random 12-character folder under `C:\ProgramData\`, named like an updater: RuntimeBroker, SecurityHealthHost, SearchHost, TextInputHost, MicrosoftEdgeUpdate, GoogleUpdate, OneDriveStandaloneUpdater, nvcontainer or AdobeARM.
- A **hidden scheduled task** registered via COM (so rules keyed on schtasks.exe miss it) with `PT15M` / `P3650D`. Varonis gives a Sigma rule on Security events **4698/4702** matching Interval PT15M, Duration P3650D, Hidden true and a ProgramData path.
- When elevated, it runs `Add-MpPreference -ExclusionPath` for its folder.
- Chrome, Edge or Brave is started suspended and receives about 26 KB of injected code. Moments later a GUID-named .txt holding 64 hex characters appears in ProgramData and is deleted.
- It exits on Russian, Ukrainian, Belarusian, Kazakh and Uzbek system languages. The mutex is `Local\<user>.<computer>`.

**Network:** HTTP POSTs to the root path of a bare IP with `Content-Type: application/json` but a Base64 ciphertext body. The analyzed build used 93.152.213.215, 91.92.43.45 and 193.148.56.97 on port 80. **IOCs:** SHA-256 `ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e` (stadia_x32.exe, agent 1.1.2), imphash `028afae8b5e9953e1cd84a003c42fd85`, helper blob `0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4`, RC4 string key `eepkTOgSwdNCgrhITR`, marker `STADIA_BETA`. Varonis didn't establish a delivery method.

Sources: [Varonis Threat Labs: StealC Is Back, and This Time It's a RAT (updated Oct 22)](https://www.varonis.com/blog/stealc-returns)