Crimeware / operación de malware

EsqueleStҽaler

Origen: México Estado: Activo Confianza: Confirmado

EsqueleStealer is a validated Windows information-stealing and loader platform associated with EsqueleSquad. Public samples analyzed in January–February 2025 used a Deno-compiled JavaScript dropper, Nuitka-packed Python components, multi-stage downloads, VM checks, broad Microsoft Defender exclusions, scheduled-task and Run-key persistence, a fodhelper UAC bypass and collection of browser, system, social, gaming and session data. The analyzed build also displayed substantial reliability defects and inflated capability claims, but technical weakness does not eliminate credential-theft and persistence risk.

INFERENCE (confidence: medium): The current profile should be updated through event-level validation rather than by inheriting capabilities from associated personas, channels or adjacent ecosystems.

Creado por iQBlack CTI Team

Colaboradores 1

Última actualización 2026-08-26

ATT&CK

MITRE ATT&CK

T1041Exfiltration Over C2 Channel

T1053.005Scheduled Task

T1060Registry Run Keys / Startup Folder

T1082System Information Discovery

T1105Ingress Tool Transfer

T1113Screen Capture

T1497.001System Checks

T1548.002Bypass User Account Control

T1555.003Credentials from Web Browsers

T1562.001Disable or Modify Tools

Research

OSINT seleccionado

Automated malware analysis — Esquele StealerJoe Sandbox Reversing EsqueleStealerPatyk