StealerBot
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The file exploits a known vulnerability (CVE-2017-11882) to run a malicious shellcode and initiate a multi-level infection process that leads to the installation of malware we have named “Backdoor Loader”.
→ DLL sideloading via legitimate signed binary → StealerBot (modular, in-memory espionage framework) | The DOCX file exploits CVE-2017-0199 to fetch a remote template from internal-advisory-azerbaijan-russia-diplomatic-crisis[.]defence-np[.]net.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This acts as a loader for “StealerBot”, a private post-exploitation toolkit used exclusively by SideWinder.
Techniques & procedures
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
4 techniques
Execution
By default, the malware starts a new “cmd.exe” process, forwards data received from the attacker to its standard input, and forwards the process output or error pipeline to the attacker.
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
6 techniques
Stealth
The remote HTA embeds a heavily obfuscated JavaScript file... strings, initially encoded with a substitution algorithm... embedded within its code as a base64-encoded .NET serialized stream.
the embedded JavaScript runs the Windows utility mshta . exe and obtains additional code from a remote server
The RTF delivery includes server-side geofencing (likely IP-based victim filtering) and User-Agent validation requiring legitimate Microsoft Office strings, ensuring that sandboxes and researchers receive decoy content or 404s.
Credential Access
5 techniques
Credential Access
This module attempts to harvest the user’s Windows credentials by displaying a phishing prompt designed to deceive the victim.
This module uses the “SetWindowsHookEx” function specified in the “user32.dll” library to install a hook procedure and monitor low-level keyboard and mouse input events. The malware can log keystrokes...
The module is a .NET library designed to steal Google Chrome browser cookies and authentication tokens related to Facebook, LinkedIn and Google services...
Discovery
1 technique
Discovery
Collection
5 techniques
Collection
The File Stealer module collects files from specific directories. It also scans removable drives to steal files with specific extensions.
It also scans removable drives to steal files with specific extensions.
This module attempts to harvest the user’s Windows credentials by displaying a phishing prompt designed to deceive the victim.
Command and Control
3 techniques
Command and Control
A single MD5 hash and a filename... Behind that hash was a SideWinder APT command-and-control domain hosting four simultaneous espionage campaigns...
IOCs tracked for this family
217 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A SideWinder-exclusive modular in-memory espionage framework used as the final payload. Recovered modules include keylogging, reverse shell access, screenshot capture, file theft, UAC bypass, RDP credential theft, token grabbing from browsers and online services, and credential phishing via spoofed Windows credential prompts.
A modular .NET espionage implant used post-compromise by SideWinder. It is loaded in memory by a backdoor loader and managed by an Orchestrator component that communicates with C2 to load plugins. Observed capabilities include installing additional malware, capturing screenshots, keylogging, stealing browser passwords and tokens, intercepting RDP credentials, stealing files, launching a reverse shell/live console, phishing Windows credentials, and bypassing UAC.
A sophisticated in-memory implant and private post-exploitation toolkit used exclusively by SideWinder for espionage-oriented operations. In this campaign it is loaded into memory by Backdoor Loader, and the article notes the implant itself remained unchanged while loader variants evolved.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.