Full Report
When Celestial Stealer runs in the wild, it looks for Huntress’ own Jai Minton as a potential threat, and this shuts down the infostealer operation if his name is detected.
Analysis Summary
# Tool/Technique: Celestial Stealer
## Overview
Celestial Stealer is a JavaScript-based Information Stealer (infostealer) distributed via a Malware-as-a-Service (MaaS) model. It is designed to harvest sensitive data—including browser credentials, session cookies, credit card information, and cryptocurrency wallets—from infected host systems. It is notable for its aggressive anti-analysis and anti-virtual machine (anti-VM) checks, which include a "do-not-engage" list of specific security researchers and computer names.
## Technical Details
- **Type:** Malware (Infostealer) / Malware-as-a-Service (MaaS)
- **Platform:** Windows (Targeted via Node.js/Electron environments)
- **Capabilities:** Credential theft, data exfiltration, anti-analysis, and obfuscation.
- **First Seen:** Publicly detailed in early 2025 (active via Telegram-based MaaS).
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1059.007 - Command and Scripting Interpreter: JavaScript]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1033 - System Owner/User Discovery]
- [T1497.001 - Virtualization/Sandbox Evasion: System Checks]
- **[TA0009 - Collection]**
- [T1539 - Steal Web Session Cookie]
- [T1555 - Credentials from Password Stores]
- **[TA0005 - Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1497 - Virtualization/Sandbox Evasion]
## Functionality
### Core Capabilities
- **Credential Harvesting:** Steals saved passwords and auto-fill data from various web browsers.
- **Financial Theft:** Targets saved credit card information and local cryptocurrency wallet files.
- **Session Hijacking:** Extracts cookies to bypass Multi-Factor Authentication (MFA) via session replay.
- **Data Exfiltration:** Packages stolen data and transmits it to attacker-controlled infrastructure (often via Telegram bots or webhooks).
### Advanced Features
- **Researcher Avoidance:** Maintains a hardcoded list of usernames (e.g., "Jai Minton") and computer handles (e.g., "cyberraiju"). If these strings are detected during the initial execution check, the malware terminates immediately.
- **Anti-Analysis/VM:** Performs environmental checks to detect sandboxes or virtual machines.
- **Deployment Flexibility:** Can be packaged as standalone Electron or Node.js applications to blend in with legitimate developer tools.
- **Obfuscation:** Utilizes advanced JavaScript obfuscation to hinder static analysis and signature-based detection.
## Indicators of Compromise
- **File Hashes:** Specific hashes vary due to the MaaS nature and frequent updates (Refer to Trellix/Huntress reports for latest SHA256 samples).
- **File Names:** Often disguised as legitimate utility software or developer tools (Node.js/Electron).
- **Network Indicators:**
- Communications often routed to `api.telegram[.]org`.
- C2 channels via developer-focused domains or specific MaaS-related webhooks.
- **Behavioral Indicators:**
- Unexpected Node.js processes reaching out to external networks.
- Rapid, unauthorized access to browser profile folders (e.g., `AppData\Local\Google\Chrome\User Data`).
## Associated Threat Actors
- Distributed by various low-to-mid-tier threat actors via **Telegram** under the "Celestial Stealer" brand.
## Detection Methods
- **Signature-based detection:** Scanning for specific JavaScript obfuscation patterns used by the Celestial builder.
- **Behavioral detection:** Monitoring for processes attempting to read sensitive files in `%AppData%` followed by immediate network transmission.
- **Environment Monitoring:** Identifying unusual child processes spawned by Node.js or Electron applications.
## Mitigation Strategies
- **Endpoint Protection:** Use EDR solutions that can monitor script-based execution and API calls to sensitive file paths.
- **Application Whitelisting:** Restrict the execution of unsigned Node.js or Electron binaries.
- **Credential Hygiene:** Use dedicated Password Managers and hardware security keys (FIDO2) to reduce the impact of stolen cookies/passwords.
- **Network Filtering:** Block or monitor outbound traffic to known malicious Telegram bot IDs or unauthorized webhooks.
## Related Tools/Techniques
- **SectopRAT:** Another stealer/RAT often distributed in similar campaigns.
- **LUMMA Stealer:** A high-profile competitor in the MaaS infostealer market.
- **Anti-Analysis (Technique):** Use of specific researcher names (like Jai Minton) is a niche but effective method of avoiding high-quality analysis.