Stealerium and its derivatives
Stealerium profileDerivatives were produced by reusing the code of the open-source Stealerium; Proofpoint reported in 2025 that its use in email campaigns had increased. Proofpoint
A tool that produces a new copy of a malware configured with the attacker’s server address and chosen features.
A builder lets the customer produce their own malware file without writing code: which data to collect, where logs go and how the file looks are chosen from a form. BlackBerry
Open-source or leaked builders give rise to many new families derived from the first version; this is why families with different names that look very similar are seen. K7 Labs
Server address or Telegram bot details, types of data to collect, icon and file name.
The builder embeds the configuration in the body and outputs a new executable. MITRE ATT&CK
The file is often passed through a crypter to evade antivirus signatures. MITRE ATT&CK
Derivatives were produced by reusing the code of the open-source Stealerium; Proofpoint reported in 2025 that its use in email campaigns had increased. Proofpoint
Open-source infostealers written in Python, such as Blank Grabber, are published with builder interfaces and become the basis for new families. K7 Labs
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy