DeerStealer is a multi-stage information-stealing malware distributed via ZIP archives and sold/supported on dark-web forums and Telegram, using signed binaries, legitimate DLLs, and decoy installers to evade detection and maintain long-term persistence. It harvests a wide range of data and exfiltrates it to shifting C2 domains such as telluricaphelion[.]com and loadinnnhr[.]today. #DeerStealer #telluricaphelion[.]com
Keypoints
- DeerStealer is an information stealer delivered as ZIP archives (e.g., Reader_pl_install.zip) that masquerades as legitimate software to trick users into execution.
- The malware uses signed executables and legitimate DLLs (e.g., VCRUNTIME140.dll) and stolen certificates to evade detection and appear trustworthy.
- Multi-stage execution loads payloads (Reader_pl_install.exe → XPFix.exe → BinaryBri86.exe → Grid-Electr.exe) and employs scheduled tasks for persistence (zceWriter, dyApp, Pluginsecurity_dbg).
- Uses UAC bypass via auto-elevated COM object (ICMLuaUtil) to launch a legitimate Adobe installer as a decoy while executing malicious components.
- Demonstrates rootkit-like behavior by hiding files in memory (e.g., C6E653E.tmp) and obfuscating payloads (Reasqueer.efi, Clortkead.ze) to avoid user-mode detection.
- Exfiltrates harvested data (credentials, browser data, crypto wallets, Office files, VPN/FTP clients, chat/email data) to C2 domains and IPs such as telluricaphelion[.]com and 104.21.112[.]1, and can migrate C2 servers to evade defenses.
- Offered for sale and support by actor(s) on forums and Telegram (noted seller @LuciferXfiles) under names including “DeerStealer” and “XFiles Spyware.”
MITRE Techniques
- [T1566 ] Phishing / drive-by – Delivery via deceptive ZIP archive and malicious installer masquerading as legitimate software: ‘delivered as a ZIP archive containing PE files… disguising itself as legitimate software.’
- [T1189 ] Drive-by Compromise – Use of malicious installer in a seemingly benign download package: ‘delivered as the fake document reader update package.’
- [T1204 ] User Execution – Requires user to run the installer/ZIP contents: ‘masquerading as the legitimate software to trick users into execution.’
- [T1059 ] Command and Scripting Interpreter – Uses msiexec.exe custom actions to execute embedded malicious payloads: ‘msiexec.exe triggers its custom action, which copies and executes Jc6716jK… as Grid-Electr.exe.’
- [T1053.005 ] Scheduled Task – Persistence via creation of scheduled tasks like zceWriter, dyApp, Pluginsecurity_dbg: ‘creates and writes to the zceWriter.job file in the C:WindowsTasks directory.’
- [T1036 ] Masquerading – Uses legitimate Adobe installer and signed binaries as decoys: ‘drops Reader_en_install.exe… the legitimate Adobe Acrobat Reader installer… used as a deception.’
- [T1070.004 ] Signed Binary Proxy Execution – Uses signed executables and DLLs (stolen certificates) to run malicious code: ‘signed with a valid digital certificate that appears to have been stolen from the issuing organization.’
- [T1027 ] Obfuscated Files or Information – Contains obfuscated files (Reasqueer.efi, Clortkead.ze) and obfuscated scheduled task content: ‘Reasqueer.efi and Clortkead.ze contain obfuscated content… The content of the zceWriter.job file is obfuscated.’
- [T1014 ] Rootkit – Rootkit-like behavior hides payloads in memory (C6E653E.tmp) to evade user-mode tools: ‘hidden by the user-level process and cannot be accessed using standard user-mode tools… indicates rootkit-like capabilities.’
- [T1497 ] Virtualization/Sandbox Evasion – Uses checks/techniques to avoid analysis environments (noted as sandbox evasion techniques in behavior): ‘Virtualization/Sandbox Evasion’ listed among evasion methods.
- [T1082 ] System Information Discovery – Collects system and installed software information for reconnaissance: ‘steals system info… installed software.’
- [T1087.001 ] Account Discovery – Gathers local account information as part of collection: ‘Local Account’ listed under discovery techniques.
- [T1217 ] Browser Credential Discovery – Harvests browser data and credentials: ‘web browser data’ targeted for theft.
- [T1673 ] Virtual Machine Discovery – Performs VM checks to evade sandbox/analysis: ‘Virtual Machine Discovery’ included in discovery techniques.
- [T1005 ] Data from Local System – Collects local files and artifacts such as Office files, media, OneDrive: ‘Steals… Office files, OneDrive…’
- [T1056 ] Input Capture – Captures input or credentials from applications and services: ‘Input Capture’ listed under collection techniques.
- [T1041 ] Exfiltration Over C2 Channel – Exfiltrates harvested data to C2 domains like telluricaphelion[.]com: ‘harvested data is subsequently exfiltrated to the C2 server at telluricaphelion[.]com.’
- [T1001 ] Data Obfuscation – Uses obfuscation/encryption when communicating or storing data to evade inspection: ‘Data obfuscation’ cited as an adaptive technique for C2 and payloads.
- [T1548.002 ] Bypass User Account Control – UAC bypass via auto-elevated COM object (ICMLuaUtil) to run elevated processes without prompt: ‘leveraged a trusted, auto-elevated COM object (ICMLuaUtil) via DllHost.exe to execute Reader_en_install.exe without triggering a User Account Control (UAC) prompt.’
Indicators of Compromise
- [File Hash ] Malicious delivery and executables – a03cec07324b0c3227e4f060b0fefc24d35482dfe690bc86df1a53211629837e (Reader_pl_install.zip), b7ee370878fb4290097311e652222d8bab91c44a94063ea192100d4fd9dadb14 (Reader_pl_install.exe)
- [File Hash ] Additional payloads – e189e7fe9cd6d63ecece8b8e8fafb773003db6009fb0c45dc2b21e77167938ba (BinaryBri86.exe), 0feaaabe6d0a2e29b636cf1f5f9d1b3f727518507ffc93fc881d64feefa2ab81 (SOSOLXQT.msi)
- [Domain ] C2 infrastructure – telluricaphelion[.]com (primary exfiltration C2), loadinnnhr[.]today (malicious MSI download)
- [IP Address ] C2 endpoints – 104.21.112[.]1 (observed C2), 103.246.144[.]118 (observed C2)
- [Scheduled Task ] Persistence artifacts – Task Name: zceWriter (creates scheduled job to relaunch components), Task Name: dyApp (persistence mechanism)
- [File Path ] Dropped/malicious directories – C:Users[user-name]AppDataRoamingDebugdebugIRG_debugZZDCDNTCCJTZXIUKRCZH (malware binary presence), C:ProgramDataDebugdebugIRG_debug (malicious binaries)