Loading malware…
Bandit Stealer is a Go-based information-stealing malware family primarily targeting Windows systems. It is designed to harvest a broad range of victim data, with emphasis on Chromium-family browser credentials and secrets, browser cookies, browsing history, stored payment-card data, Telegram Desktop session data, cryptocurrency wallets, password managers, FTP clients, email clients, messaging applications, and other locally stored authentication material. The malware also performs host profiling by collecting system identifiers and environment details such as username, computer name, hardware UUID, operating system characteristics, disk information, screen dimensions, geolocation-related data, and User Account Control status.
A notable feature of Bandit Stealer is its anti-analysis and anti-sandbox logic. Reported samples check for virtualization and sandbox artifacts, blacklisted usernames, hostnames, MAC addresses, hardware identifiers, IP addresses, and analysis-related processes. It has also been observed attempting to terminate processes associated with debugging or malware analysis tools. Some samples include debugger-detection logic and embedded Linux-oriented anti-analysis artifacts, suggesting either code reuse or unfinished cross-platform development, although operational targeting is centered on Windows.
Bandit Stealer establishes persistence on Windows through the current-user Run autorun mechanism. It has also been observed attempting privilege escalation by invoking the Windows runas utility, though this method depends on administrator credentials and is not inherently reliable. Collected data is staged locally, commonly organized into victim-specific directories and compressed into archives before exfiltration.
Exfiltration has been observed through the Telegram Bot API, and some samples also contain alternate upload or VPS-oriented network paths. Reverse-engineering of Bandit Stealer indicates ongoing evolution in operator tradecraft: early builds exposed plaintext strings and were comparatively easy to analyze, while later versions adopted stronger Go obfuscation, including Garble-based method and string obfuscation. Public reporting has also noted weaknesses in at least some Bandit Stealer operator panels, but there is insufficient evidence to confidently attribute the malware to a specific threat actor. Delivery has been observed via Windows droppers and self-extracting archives masquerading as benign software or documents, often paired with decoy content to distract victims during execution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
sc create ... StartServiceW ... ControlService ... CreateServiceW ... DeleteService | OpenSCManagerW, OpenServiceW, StartServiceW, CreateServiceW, ChangeServiceConfigW, DeleteService
Bandit Stealer creates a registry entry for autorun. It will create an autorun registry entry < HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run > with a value name “BANDIT STEALER” to ensure that the malware is executed every time the infected system starts up or restarts.
VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, QueueUserAPC, SetThreadContext, NtUnmapViewOfSection, VirtualProtectEx | CreateRemoteThread ... VirtualProtectEx ... WriteProcessMemory ... QueueUserAPC
sc create ... StartServiceW ... ControlService ... CreateServiceW ... DeleteService | OpenSCManagerW, OpenServiceW, StartServiceW, CreateServiceW, ChangeServiceConfigW, DeleteService
Bandit Stealer creates a registry entry for autorun. It will create an autorun registry entry < HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run > with a value name “BANDIT STEALER” to ensure that the malware is executed every time the infected system starts up or restarts.
Later versions of the stealer attempted to slightly obfuscate the method names and ultimately moved to using Garble ... a GO obfuscator. Garble is able to obfuscate GO method names, obfuscate strings, and modify control flow.
Later versions of the stealer attempted to slightly obfuscate the method names and ultimately moved to using Garble ... a GO obfuscator.
The method names are obfuscated using a hash which is then base64 encoded.
VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, QueueUserAPC, SetThreadContext, NtUnmapViewOfSection, VirtualProtectEx | CreateRemoteThread ... VirtualProtectEx ... WriteProcessMemory ... QueueUserAPC
Once the malware checks for blacklisted IP addresses, MAC addresses, HWIDs, and users, it will proceed to terminate blacklisted processes related to malware analysis tools.
VirtualBox; vmwareuser.exe; vgauthservice.exe; qemu-ga.exe; joeboxcontrol.exe; C:\Windows\System32\drivers\VBoxSF.sys; /proc/self/status | vboxservice.exe, vboxtray.exe, vmtoolsd.exe, vmwareuser.exe, qemu-ga.exe, xenservice.exe, joeboxcontrol.exe, /proc/self/status, VirtualBox
CredEnumerateW, CryptUnprotectData, Login Data, Local State, os_crypt, SELECT name, value, date_created FROM autofill, %s_cookies.txt, %s_logins.txt | Login Data; Local State; os_crypt; %s_login_data.txt; URL: %s Title: %s Visited Time: %s | MiniDumpWriteDump ... CreateRemoteThread ... PssCaptureSnapshot ... ReadProcessMemory ... WriteProcessMemory
GetAsyncKeyState; GetKeyState; GetKeyboardLayout | GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetAsyncKeyState
discord_token.txt ... Telegram.exe | Telegram Desktop, Telegram.exe, sessiondata, user_data, Slack\storage\, Signal\sql\, Discord-like app/session artifacts
InternetGetCookieExW, %s_cookies.txt, Slack_Cookies, Cookies\, Login Data | Login Data ... Local State ... os_crypt ... URL: %s Title: %s Visited Time: %s ... tempLoginData
git-credentials pgpass.conf winauth.xml accounts.dat settings-security.xml
git-credentials, pgpass.conf, accounts.xml, accounts.ini, auth.json, settings-security.xml, confCons.xml, sitemanager.xml
Login Data ... Local State ... os_crypt ... failed to open database: %s ... Name: %s Value: %s
iexplore.exe msedge.exe maxthon.exe seamonkey.exe orbitum.exe browser.exe ... Login Data Local State os_crypt
CertOpenStore ... CertOpenSystemStoreW ... CertAddCertificateContextToStore ... CertFindCertificateInStore ... CertGetCertificateChain | Telegram Desktop; auth.json; settings-security.xml; \1Password\data\; \NordPass\; winauth.xml; accounts.dat | CertOpenSystemStoreW, CertFindCertificateInStore, PFXImportCertStore, CryptAcquireCertificatePrivateKey
Bandit Stealer creates a registry entry for autorun. It will create an autorun registry entry < HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run >
The malware will retrieve the current username using os_user_Current and device name using os_hostname.
CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, EnumProcesses | fiddler.exe; regedit.exe; ollydbg.exe; pestudio.exe; processhacker; wireshark.exe; Procmon64.exe; EnumProcesses; CreateToolhelp32Snapshot; Process32FirstW
systeminfo, Processor(s):, Username: %s Computer Name: %s IP Address: %s, Total Size: %.2f GB Free Space: %.2f GB, UAC Info: | systeminfo ... Processor(s): ... Screen Size: ... UAC Info: ... USERINFO.txt ... ComputerNameEx | systeminfo; Processor(s):; Screen Size:; UAC Info:; System Manufacturer:; System Model:; Total Physical Memory:; USERINFO.txt
VirtualBox; vmwareuser.exe; vgauthservice.exe; qemu-ga.exe; joeboxcontrol.exe; C:\Windows\System32\drivers\VBoxSF.sys; /proc/self/status | vboxservice.exe, vboxtray.exe, vmtoolsd.exe, vmwareuser.exe, qemu-ga.exe, xenservice.exe, joeboxcontrol.exe, /proc/self/status, VirtualBox
VirtualBox ... /proc/self/status ... systeminfo ... vmwareuser.exe ... vgauthservice.exe ... qemu-ga.exe ... xenservice.exe ... ollydbg.exe ... x32dbg.exe ... processhacker
Numerous targeted paths including wallet.dat, FileZilla, Thunderbird, NordPass, 1Password, OpenVPN Connect, qBittorrent.ini, ShareX, GitHub Desktop | discord_token.txt ... Telegram.exe ... USERINFO.txt ... numerous paths for wallets, FTP clients, mail clients, browsers, and application configs | Atomic Wallet; Exodus; wallet.dat; address.db; FileZilla; confCons.xml; pgpass.conf; \Slack\storage\; \Signal\sql\; USERINFO.txt
GetAsyncKeyState; GetKeyState; GetKeyboardLayout | GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetAsyncKeyState
GetDC; CreateCompatibleDC; PrintWindow; StretchBlt; GetDIBits | GetDC failed, CreateCompatibleBitmap failed, BitBlt failed, PrintWindow, GetWindowRect, GetForegroundWindow
OpenClipboard, GetClipboardData, CloseClipboard, SetClipboardData | OpenClipboard; GetClipboardData; CloseClipboard
74 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information-stealing malware with anti-VM, anti-sandbox, and anti-debugging checks. It enumerates processes and environment artifacts to detect analysis systems, gathers host identifiers such as UUID, screen dimensions, external IP, MAC address, username, and computer name, and exits when blacklist matches are found. It steals browser credentials, cookies, history, and credit card data; targets cryptocurrency wallets, FTP clients, and email clients; and can also harvest keystrokes and clipboard data.
An information-stealing malware focused on harvesting browser data, credentials, tokens, cryptocurrency wallets, messaging data, FTP/email client data, and system/user information, with apparent anti-analysis checks and exfiltration/collection behavior.
Credential and information stealer targeting browser data, crypto wallets, Telegram data, FTP/email clients, and other local application secrets; includes anti-analysis/anti-VM checks and exfiltration via HTTP/Telegram.
Information-stealing malware targeting browser credentials, cookies, autofill data, crypto wallets, Telegram data, FTP/VPN/email clients, and other local application secrets, then packaging and exfiltrating the data via Telegram/VPS infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.