Loading malware…
Mint Stealer is a Python-based information-stealing malware sold through a malware-as-a-service model and associated with the Cashout criminal ecosystem. It targets Windows systems and is designed to harvest sensitive data from web browsers, cryptocurrency wallets, VPN clients, mail and messaging applications, FTP and file-management tools, gaming applications, and the system clipboard. The malware also performs host profiling by collecting system information.
Observed execution involves a staged loader chain in which an initial executable extracts a second-stage payload and supporting components into a temporary working directory, then launches the payload. The payload has been observed as a Nuitka-compiled Python executable that loads bundled modules and libraries from the temporary directory into memory. Mint Stealer uses obfuscation and encryption to hinder analysis and detection.
After collection, Mint Stealer stores stolen data in a temporary staging directory, compresses it into an archive, and exfiltrates the results. Reporting has linked the malware to uploads to public file-sharing services, followed by transmission of a summary and retrieval link to operator-controlled infrastructure. Operator support and sales have been advertised via dedicated websites and Telegram channels. Mint Stealer is positioned as a commodity stealer for credential and wallet theft, with emphasis on bypassing endpoint defenses and broad application coverage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It is also branded on the Telegram channel of the group, dedicated to Mint Stealer, another product sold on the cashout store.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Mint Stealer uses encryption and obfuscation techniques to evade detection and enhance its effectiveness on infected endpoints.
The primary specimen acts as a dropper, with the main payload hidden in a compressed form within the resource section of the executable.
vadimloader.exe reads all the files in the Temp/onefile_1512_… directory, including subfolders, and loads the required libraries and code into the process memory for its operation.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Python-based information stealer sold as malware-as-a-service that covertly exfiltrates sensitive data from infected Windows endpoints to a C2 server. It steals data from browsers, cryptocurrency wallets, VPN/FTP/mail/messaging clients, game applications, system information, and clipboard contents, and uses encryption and obfuscation to evade detection.
Information-stealing malware sold as a malware-as-a-service offering. It exfiltrates browser data, cryptocurrency wallet data, gaming credentials, VPN and messaging app data, FTP/file-management data, system information, and clipboard contents; uses encryption, obfuscation, compression, debugger/analysis checks, uploads stolen archives to file-sharing sites, and sends download URLs plus summaries to its C2.
Mint Stealer is a stealer malware designed to exfiltrate sensitive information from infected systems.
A separate malicious product sold in the same Cashout ecosystem and used here mainly as contextual linkage to the branding/channel associated with CashRansomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.