Loading story…
Researchers reported that Qealler, also tracked as Pyrogenic, operated as a heavily obfuscated Java-based infostealer delivered through socially engineered .jar files themed as invoices, remittances, and payment advice. The malware contacted attacker-controlled infrastructure, including 157.245.160[.]150:80, queried external services for the victim’s public IP, launched cmd.exe and PowerShell, dropped components such as sqlitejdbc.dll and jnidispatch.dll, and harvested credentials and host data from Windows systems before encrypting and exfiltrating the results. Analysis also found that the loader downloaded encrypted secondary components, unpacked a repackaged 7-Zip utility and a password-protected payload, and executed a bundled Python environment containing a customized credential stealer derived from LaZagne.
Separate reverse-engineering of older and newer samples found strong code-level continuity between Qealler and Pyrogenic variants, indicating shared development rather than unrelated malware. Both variants reportedly used the same Qrypter packer variant, the same AES key value, and the same UUID-related configuration key, while collecting system information in JSON format and using a JVM shutdown hook to delete files after execution. The newer sample added localIpAddress and globalIpAddress fields to the stolen host profile, and a memory artifact referencing QeallerV4.kotlin_module suggested the malware had evolved into a later version while retaining its original architecture and credential-theft workflow.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
The newer sample included the memory artifact string "QeallerV4.kotlin_module," which Securityinbits assessed may indicate the Pyrogenic/Qealler sample is version 4; the analysis also noted added localIpAddress and globalIpAddress fields in collected system information.
A follow-up comparison found the older Qealler sample and newer Pyrogenic/Qealler sample shared the same Qrypter packer variant, AES key bbb6fec5ebef0d93, UUID-related configuration key, JSON-based system information collection, and JVM shutdown-hook file deletion behavior.
Securityinbits concluded the sample used encrypted Java classes protected with AES/ECB/PKCS5Padding and likely PBKDF2WithHmacSHA1-derived keys, rather than a custom decryption algorithm.
During dynamic analysis, the sample contacted 157.245.160[.]150 over port 80, launched cmd.exe and PowerShell, dropped and later deleted sqlitejdbc.dll and jnidispatch.dll, queried bot.whatismyipaddress.com, and stole credentials from multiple applications.
Securityinbits analyzed a Java-based infostealer sample named BankPaymAdviceVend_LLCRep.jar (MD5 F0E21C7789CD57EEBF8ECDB9FADAB26B), describing Qealler/Pyrogenic as active in ANY.RUN submissions and reportedly targeting organizations in Australia, Africa, and the Middle East.
Zscaler analyzed Qealler as a heavily obfuscated Java loader that decrypted URLs, downloaded components from 82.196.11[.]96, unpacked a password-protected payload with bundled 7-Zip, executed a customized LaZagne-derived stealer, and exfiltrated encrypted system and credential data.
In January 2019, a Qealler campaign used invoice- and remittance-themed malicious JAR files distributed via compromised websites, including a Remittance.jar sample downloaded from hiexsgroup.co[.]uk.
Zscaler ThreatLabZ first observed the Qealler payload in Zscaler Cloud Sandbox on January 21, 2019, identifying a Java-based loader used to deliver a credential-harvesting payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 62 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securityinbits.com
Open sourcesecurityinbits.com
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers across multiple security firms documented how **QakBot** (also known as **Qbot**) has evolved from a banking trojan into a stealthier modular malware platform that steals credentials, injects into processes such as `explorer.exe`, and can act as a loader for follow-on ransomware. Reports describe delivery through phishing documents, exploit droppers, and open shares, with campaigns targeting financial institutions in the United States and additional banks in Canada and the Netherlands. Analysts also observed persistent development activity, frequent packing changes, browser-injection capabilities, FTP exfiltration, DGA-based command-and-control behavior, and increasingly organized build practices designed to frustrate signature-based detection. More recent samples show QakBot reducing on-disk artifacts by storing configuration in the Windows Registry, writing Run-key persistence only around shutdown or reboot, and deleting dropped components after execution on the next boot. Researchers also detailed anti-analysis checks for Windows Defender, Sandboxie, analyst tooling, VMware artifacts, RAM heuristics, and CPUID-based virtualization detection, alongside encrypted resources and string tables that hide campaign IDs and C2 infrastructure. To counter that obfuscation, defenders published tooling and workflows to recover QakBot configurations, strings, embedded payloads, and RC4- or AES-protected data at scale, including extractors for PE resources, memory-carving approaches for injected payloads, and Binary Ninja automation that recovered campaign data and live C2 endpoints from 64-bit samples.
Aug 15, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026