TerraStealerV2
TerraStealerV2 is a Windows credential and data stealer attributed by Recorded Future Insikt Group to the financially motivated Golden Chickens threat actor, also known as Venom Spider/TA4557, and observed between January and April 2025. It is designed to collect browser credentials, cryptocurrency wallet data, and browser extension information. Reporting states it targets Google Chrome’s "Login Data" database, copies it to C:\ProgramData\Temp\LoginData, and queries it with SQLite using "SELECT origin_url, username_value, password_value FROM logins." It also collects host information via GetUserNameA and GetComputerNameA, attempts to determine the victim IP address via ifconfig[.]me, enumerates processes, looks for chrome.exe, and may terminate it to release database locks. The malware copies targeted wallet and extension directories into %LOCALAPPDATA%\Packages\Bay0NsQIzx, compresses the contents into output.zip, and writes exfiltration data/messages to C:\ProgramData\file.txt with a copy at %LOCALAPPDATA%\Packages\Bay0NsQIzx\p.txt.
TerraStealerV2 has been distributed in multiple formats including LNK, MSI, DLL, and EXE, but the stealer payload is intended to be delivered as an OCX file and executed via regsvr32.exe calling DllRegisterServer. Observed delivery chains retrieved the OCX from wetransfers[.]io/v.php using curl or PowerShell, and some activity overlapped with ClickFix-style tradecraft, including mshta.exe execution of a payload disguised as an MP4. The malware performs anti-analysis checks, including verifying the .ocx extension, a hard-coded filename ending, and that it is being executed by regsvr32.exe. Strings are deobfuscated with an XOR routine using a hard-coded key. It leverages trusted Windows utilities such as regsvr32.exe and mshta.exe for execution and evasion.
Exfiltration was observed to Telegram, including an initial victim-information message to a Telegram channel named "Noterdam" using a bot token associated with "NoterdanssBot," and to the domain wetransfers[.]io, including uploads to wetransfers[.]io/uplo.php. The domain wetransfers[.]io was reported as registered on February 18, 2025 via NameCheap and hosted behind Cloudflare. Additional reported indicators and artifacts include ifconfig[.]me, wetransfers[.]io, C:\ProgramData\Temp\LoginData, C:\ProgramData\file.txt, %LOCALAPPDATA%\Packages\Bay0NsQIzx\p.txt, and output.zip. One reported sample had SHA-256 9aed0eda60e4e1138be5d6d8d0280343a3cf6b30d39a704b2d00503261adbe2a, and another sample contained a PDB path referencing "NOK.pdb."
The reporting notes TerraStealerV2 does not bypass Chrome Application Bound Encryption (ABE) protections introduced after July 2024, limiting its ability to decrypt passwords on updated systems and suggesting the malware is immature, outdated, or still under active development. High-confidence reporting directly describes its theft focus as browser credentials, cryptocurrency wallet data, and browser extension information.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"C. TerraStealerV2 Credential-harvesting malware targeting browsers, FTP clients, and email platforms."
"C. TerraStealerV2 Credential-harvesting malware targeting browsers, FTP clients, and email platforms."
Insikt Group identified two new malware families — TerraStealerV2 and TerraLogger — linked to the financially motivated threat actor Golden Chickens (also known as Venom Spider). TerraStealerV2 is designed to collect browser credentials, cryptocurrency wallet data, and browser extension information.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueMultiple entries describe malicious packages (npm/PyPI/Go modules) used to drop payloads, backdoor software, steal credentials/keys, or wipe disks.
IOCs tracked for this family
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Steals browser credentials, cryptocurrency wallet data, and browser extension information.
Information stealer associated with Golden Chickens MaaS, targeting credentials, crypto wallet data, and browser/extension information.
A Golden Chickens-associated stealer component referenced in detection rules, with network/HTTP connection telemetry (including a specific RemoteUrl condition in the updated rule) used to identify activity.
Credential and data stealer that targets browser-stored credentials (Chrome Login Data), cryptocurrency wallet data, and browser extension information; exfiltrates stolen data via Telegram and a secondary C2 endpoint. Delivered in multiple formats (notably OCX executed via regsvr32.exe) and uses trusted Windows utilities (regsvr32.exe, mshta.exe) for execution/evasion.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.