Malware

StealNui

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.003CronEvidence1

In the crontab, but only if at least one CRON job already exists. The inserted entry relaunches the program every five minutes.

T1059Command and Scripting InterpreterEvidence1

!exec <cmd> Executes an arbitrary command

Persistence

4 techniques

T1053.003CronEvidence1

In the crontab, but only if at least one CRON job already exists. The inserted entry relaunches the program every five minutes.

T1543.002Systemd ServiceEvidence1

In the user’s systemd configuration, specifically ~/.config/systemd/user/systemd-journal-helper-service

T1546.004Unix Shell Configuration ModificationEvidence1

In .bashrc, using a slightly different command because it runs in an interactive shell ... In .profile, once again using the same command

T1547Boot or Logon Autostart ExecutionEvidence1

In the Cross-Desktop Group (XDG) autostart, which is specific to graphical environments on Linux.

Privilege Escalation

4 techniques

T1053.003CronEvidence1

In the crontab, but only if at least one CRON job already exists. The inserted entry relaunches the program every five minutes.

T1543.002Systemd ServiceEvidence1

In the user’s systemd configuration, specifically ~/.config/systemd/user/systemd-journal-helper-service

T1546.004Unix Shell Configuration ModificationEvidence1

In .bashrc, using a slightly different command because it runs in an interactive shell ... In .profile, once again using the same command

T1547Boot or Logon Autostart ExecutionEvidence1

In the Cross-Desktop Group (XDG) autostart, which is specific to graphical environments on Linux.

Stealth

4 techniques

T1036MasqueradingEvidence1

The malware then copies itself to ~/.config/systemd-runtime/systemd-journald-helper, which becomes the binary used for subsequent executions.

T1497Virtualization/Sandbox EvasionEvidence1

When executed, the malware uses numerous methods to determine whether its execution context is being monitored. These include: CPUINFO, to determine whether it is running on a virtual CPU ... Reading /proc/modules to look for hv_vmbus, vmw_vmci ... Checking the MAC address in use, particularly whether it starts with a VM-related prefix

T1497.001System ChecksEvidence1

For example, it checks whether the hostname or username contains values such as virus, sandbox, or remnux. It then lists the running processes in search of ghidra, strace, tcpdump, and similar tools.

T1622Debugger EvasionEvidence1

Finally, it checks whether it is being debugged by calling ptrace(PTRACE_TRACEME...).

Credential Access

4 techniques

T1056.001KeyloggingEvidence1

Two keylogging methods are implemented ... If the device is accessible, it simply reads the input events ... Otherwise, it falls back to X11 ... !keylog start/stop/dump Manages the keylogging thread

T1528Steal Application Access TokenEvidence1

!tokens Retrieves Discord tokens from the machine

T1539Steal Web Session CookieEvidence1

!roblox Retrieves Roblox cookies

T1555Credentials from Password StoresEvidence1

!passwords Extracts passwords stored in the browser

Discovery

8 techniques

T1033System Owner/User DiscoveryEvidence1

It collects: The current user, including contextual information such as their shell and whether they are root

T1046Network Service DiscoveryEvidence1

It collects: ... The available network interfaces ... Interesting installed packages, such as SSH, VNC, Apache, Docker, and so on

T1057Process DiscoveryEvidence1

It collects: ... The list of running processes

T1069.001Local GroupsEvidence1

It collects: ... Sudo-enabled users

T1082System Information DiscoveryEvidence1

It collects: The hostname ... The machine configuration, including the operating system, architecture, kernel, RAM, and so on

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

For example, it checks whether the hostname or username contains values such as virus, sandbox, or remnux. It then lists the running processes in search of ghidra, strace, tcpdump, and similar tools.

T1622Debugger EvasionEvidence1

Finally, it checks whether it is being debugged by calling ptrace(PTRACE_TRACEME...).

Collection

3 techniques

T1056.001KeyloggingEvidence1

Two keylogging methods are implemented ... If the device is accessible, it simply reads the input events ... Otherwise, it falls back to X11 ... !keylog start/stop/dump Manages the keylogging thread

T1113Screen CaptureEvidence1

!screenshot Takes a screenshot of the desktop !screenshotw Takes a screenshot of the active window

T1115Clipboard DataEvidence1

While digging into the clipboard-hijacking function ... it checks the clipboard every 0.5 seconds ... The malware then clears the clipboard and injects the new address into both clipboard selections

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The C2 infrastructure is rather unusual: a Discord server, used through an API that is now deprecated, to communicate with the victim.

T1105Ingress Tool TransferEvidence1

!upload <url> <dest> Downloads an arbitrary file via curl

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

!download <path> Exfiltrates a local file

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

exatrack blogNews

Aug 6, 2026

Under the Hood - StealNui a new linux RAT clipper

A Linux C++ implant with anti-analysis checks, multiple persistence mechanisms, Discord-based C2, host reconnaissance, browser password theft, Roblox cookie theft, Discord token theft, arbitrary command execution, file upload/download, screenshots, clipboard hijacking, keylogging, and reverse shell capability. It also includes a multi-cryptocurrency clipper, though the replacement wallet addresses in this sample were left as placeholders.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

StealNui

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.003CronEvidence1

In the crontab, but only if at least one CRON job already exists. The inserted entry relaunches the program every five minutes.

T1059Command and Scripting InterpreterEvidence1

!exec <cmd> Executes an arbitrary command

Persistence

4 techniques

T1053.003CronEvidence1

In the crontab, but only if at least one CRON job already exists. The inserted entry relaunches the program every five minutes.

T1543.002Systemd ServiceEvidence1

In the user’s systemd configuration, specifically ~/.config/systemd/user/systemd-journal-helper-service

T1546.004Unix Shell Configuration ModificationEvidence1

In .bashrc, using a slightly different command because it runs in an interactive shell ... In .profile, once again using the same command

T1547Boot or Logon Autostart ExecutionEvidence1

In the Cross-Desktop Group (XDG) autostart, which is specific to graphical environments on Linux.

Privilege Escalation

4 techniques

T1053.003CronEvidence1

In the crontab, but only if at least one CRON job already exists. The inserted entry relaunches the program every five minutes.

T1543.002Systemd ServiceEvidence1

In the user’s systemd configuration, specifically ~/.config/systemd/user/systemd-journal-helper-service

T1546.004Unix Shell Configuration ModificationEvidence1

In .bashrc, using a slightly different command because it runs in an interactive shell ... In .profile, once again using the same command

T1547Boot or Logon Autostart ExecutionEvidence1

In the Cross-Desktop Group (XDG) autostart, which is specific to graphical environments on Linux.

Stealth

4 techniques

T1036MasqueradingEvidence1

The malware then copies itself to ~/.config/systemd-runtime/systemd-journald-helper, which becomes the binary used for subsequent executions.

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

For example, it checks whether the hostname or username contains values such as virus, sandbox, or remnux. It then lists the running processes in search of ghidra, strace, tcpdump, and similar tools.

T1622Debugger EvasionEvidence1

Finally, it checks whether it is being debugged by calling ptrace(PTRACE_TRACEME...).

Credential Access

4 techniques

T1056.001KeyloggingEvidence1

Two keylogging methods are implemented ... If the device is accessible, it simply reads the input events ... Otherwise, it falls back to X11 ... !keylog start/stop/dump Manages the keylogging thread

T1528Steal Application Access TokenEvidence1

!tokens Retrieves Discord tokens from the machine

T1539Steal Web Session CookieEvidence1

!roblox Retrieves Roblox cookies

T1555Credentials from Password StoresEvidence1

!passwords Extracts passwords stored in the browser

Discovery

8 techniques

T1033System Owner/User DiscoveryEvidence1

It collects: The current user, including contextual information such as their shell and whether they are root

T1046Network Service DiscoveryEvidence1

It collects: ... The available network interfaces ... Interesting installed packages, such as SSH, VNC, Apache, Docker, and so on

T1057Process DiscoveryEvidence1

It collects: ... The list of running processes

T1069.001Local GroupsEvidence1

It collects: ... Sudo-enabled users

T1082System Information DiscoveryEvidence1

It collects: The hostname ... The machine configuration, including the operating system, architecture, kernel, RAM, and so on

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

For example, it checks whether the hostname or username contains values such as virus, sandbox, or remnux. It then lists the running processes in search of ghidra, strace, tcpdump, and similar tools.

T1622Debugger EvasionEvidence1

Finally, it checks whether it is being debugged by calling ptrace(PTRACE_TRACEME...).

Collection

3 techniques

T1056.001KeyloggingEvidence1

Two keylogging methods are implemented ... If the device is accessible, it simply reads the input events ... Otherwise, it falls back to X11 ... !keylog start/stop/dump Manages the keylogging thread

T1113Screen CaptureEvidence1

!screenshot Takes a screenshot of the desktop !screenshotw Takes a screenshot of the active window

T1115Clipboard DataEvidence1

While digging into the clipboard-hijacking function ... it checks the clipboard every 0.5 seconds ... The malware then clears the clipboard and injects the new address into both clipboard selections

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The C2 infrastructure is rather unusual: a Discord server, used through an API that is now deprecated, to communicate with the victim.

T1105Ingress Tool TransferEvidence1

!upload <url> <dest> Downloads an arbitrary file via curl

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

!download <path> Exfiltrates a local file

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

exatrack blogNews

Aug 6, 2026

Under the Hood - StealNui a new linux RAT clipper

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.