Family comparison

RhadamanthysLumma StealerStealC
Capability
RhadamanthysDeclining
Lumma StealerActive
StealCActive
PlatformWindowsWindowsWindows
Dark Radar infection records134,9416,485,6181,847,820
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedVerified
Refreshing expired sessions—Reported—
AutofillDark Radar observationVerifiedVerified
macOS Keychain———
2FA and password managersVersion-dependentVerified—
Financial
Saved cardsDark Radar observationVerifiedDark Radar observation
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerifiedVerifiedVerified
Clipboard address replacement———
Applications
Email clientsVerifiedVersion-dependentVerified
FTP clientsVerified—Dark Radar observation
VPN clientsVerified——
Messaging applicationsVerifiedVersion-dependentVerified
Gaming platformsDark Radar observationDark Radar observationDark Radar observation
System
File collectionVerifiedVerifiedVerified
ScreenshotDark Radar observation—Version-dependent
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload downloadVerifiedVerifiedVerified
Persistence———
Anti-analysisVerifiedVerifiedVerified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed