Executive Abstract
Full reverse engineering report on the StealCraft loader: unpacking mechanism, second-stage injection, C2 protocol analysis, and persistence techniques. Includes YARA rules.

Detailed Threat Intelligence Breakdown

StealCraft is a modern C++ malware loader engineered to deploy second-stage infostealers and Cobalt Strike beacons. Analysis of recent malware samples shows advanced anti-analysis routines including hardware breakpoint detection, API hashing via custom MurmurHash3, and process hollowing into legitimate Windows system binaries (svchost.exe, RuntimeBroker.exe). The C2 communication utilizes custom AES-256-CBC encrypted HTTP POST requests with spoofed User-Agent strings mimicking legitimate browser update checks.

Key Findings & Strategic Observations

  • Advanced API hashing and anti-sandboxing execution checks
  • Process hollowing into trusted Windows processes
  • Custom AES-256 encrypted C2 communication protocol
  • YARA detection signatures compiled and verified