Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareRansomware

MicroStealer

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial
MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1566PhishingEvidence1

The malware spreads through fake software installers, malicious downloads hosted on platforms like Dropbox and SourceForge, and phishing lures disguised as game launchers or software updates.

Execution

1 technique
T1204User ExecutionEvidence1

It does not rely on vulnerability exploitation to get into a system. Instead, it counts on the user trusting a file enough to run it, making social engineering its primary entry point.

Privilege Escalation

1 technique
T1548Abuse Elevation Control MechanismEvidence1

This Electron app, disguised as a “Game Launcher,” presents a UAC prompt requesting administrator privileges. Once the user grants access, the application extracts a bundled Java Runtime Environment and a JAR payload...

Stealth

2 techniques
T1036MasqueradingEvidence1

This Electron app, disguised as a “Game Launcher,” presents a UAC prompt requesting administrator privileges... the Java executable is renamed “miicrosoft.exe,” a deliberate misspelling designed to mimic a legitimate Windows process name.

T1497Virtualization/Sandbox EvasionEvidence1

Before it begins, it checks the environment for signs of a virtual machine. If it detects analysis tools or sandbox processes, it stops immediately.

Credential Access

2 techniques
T1539Steal Web Session CookieEvidence1

Once inside a system, MicroStealer steals active browser sessions for SaaS platforms, VPNs, cloud services, and corporate portals.

T1555Credentials from Password StoresEvidence1

It goes after browser credentials, session cookies, desktop screenshots, cryptocurrency wallet files, and account data from platforms like Discord and Steam.

Discovery

1 technique
T1497Virtualization/Sandbox EvasionEvidence1

Before it begins, it checks the environment for signs of a virtual machine. If it detects analysis tools or sandbox processes, it stops immediately.

Collection

1 technique
T1113Screen CaptureEvidence1

If the environment appears to be a real user machine, it harvests credentials, cookies, session tokens, screenshots, and wallet files...

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

...then exfiltrates everything through two simultaneous channels: a Discord webhook and an attacker-controlled server.

T1567Exfiltration Over Web ServiceEvidence1

...then exfiltrates everything through two simultaneous channels: a Discord webhook and an attacker-controlled server.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
Start free trial
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.