The Stealer Factory: Python-Based MaaS Infostealer Builder — OTX Pulse Analysis with Enterprise Detection Pack

---
title: Python-Compiled Binary Accessing Browser Credential Stores
description: Detects PyInstaller or Nuitka-compiled executables (often unsigned, executing from user-writable paths) accessing Chromium/Gecko credential databases. Characteristic of MaaS Python infostealers like the Stealer Factory payload.
id: 7a1f3c2e-9b4d-4e6f-a1c8-5d2e9f3b7a01
status: experimental
author: Security Arsenal Threat Intel
date: 2026/09/29
logsource:
  category: file_event
  product: windows
detection:
  selection_browser_files:
    TargetFilename|contains:
      - '\Login Data'
      - '\Cookies'
      - '\Web Data'
      - '\Local State'
      - 'logins.json'
      - 'key4.db'
  selection_browser_paths:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\'
      - '\Mozilla\Firefox\Profiles\'
      - '\Opera Software\'
  selection_suspicious_procs:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\Downloads\'
  filter_legit:
    Image|contains:
      - '\Google\Chrome\Application\'
      - '\Microsoft\Edge\Application\'
      - '\Mozilla\Firefox\'
      - 'msedge.exe'
      - 'chrome.exe'
      - 'firefox.exe'
  condition: (selection_browser_files and selection_browser_paths) and selection_suspicious_procs and not filter_legit
falsepositives:
  - Legitimate password managers or backup utilities
  - Browser update processes running from temp paths (verify signature)
level: high
tags:
  - attack.credential_access
  - attack.t1555.003
---
title: Webhook Exfiltration from Non-Browser Process
description: Detects outbound HTTPS connections to Discord or Telegram webhook endpoints from processes that are not legitimate chat clients or browsers. MaaS infostealers exfiltrate XOR+Base64 encoded credential blobs via configured webhooks.
id: 2b8e4d1f-6c3a-4f9b-b7d2-8e1a4c6f9d03
status: experimental
author: Security Arsenal Threat Intel
date: 2026/09/29
logsource:
  category: network_connection
  product: windows
detection:
  selection_webhook:
    DestinationHostname|contains:
      - 'discord.com/api/webhooks'
      - 'discordapp.com/api/webhooks'
      - 'api.telegram.org'
  filter_legit:
    Image|endswith:
      - '\Discord.exe'
      - '\Telegram.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  condition: selection_webhook and not filter_legit
falsepositives:
  - Custom automation scripts posting to webhooks (rare on endpoints)
  - Developer tooling with notification integrations
level: high
tags:
  - attack.exfiltration
  - attack.t1567
---
title: Anti-VM Enumeration Behavior from Suspicious Binary
description: Detects execution of binaries from user-writable directories performing virtualization/sandbox artifact checks via WMI or registry queries, consistent with the Stealer Factory payload's anti-analysis gating before credential theft.
id: 9c5a7e2b-3d8f-4a1c-c4e6-1f7b2d8a5e09
status: experimental
author: Security Arsenal Threat Intel
date: 2026/09/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_wmi:
    Image|endswith:
      - '\powershell.exe'
      - '\wmic.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'Win32_ComputerSystem'
      - 'Win32_BIOS'
      - 'Manufacturer'
      - 'Model'
  selection_vm_strings:
    CommandLine|contains:
      - 'VirtualBox'
      - 'VMware'
      - 'QEMU'
      - 'Hyper-V'
      - 'VIRTUAL'
      - 'sandbox'
  selection_parent_suspicious:
    ParentImage|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\Downloads\'
  condition: selection_wmi and selection_vm_strings and selection_parent_suspicious
falsepositives:
  - IT inventory scripts running from temp staging paths
  - Software installers performing hardware checks
level: medium
tags:
  - attack.defense_evasion
  - attack.discovery
  - attack.t1497
  - attack.t1518.001

// Hunt for Python MaaS infostealer behavior: browser credential store access
// by unsigned/suspicious processes, followed by webhook exfiltration.
// Also includes retro-hunt for known Stealer Factory payload hashes.
let KnownHashes = dynamic([
  "429ed63ab3fbda8d22d0ac750ecfe8cc",
  "610f0c65a3f8e88559f89ed90ea9ee5c",
  "9ffe0e45c7a3f20e4481206c1c3b0854"
]);
let BrowserStoreAccess = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("Login Data", "Local State", "Web Data", "Cookies", "logins.json", "key4.db")
| where FolderPath has_any ("Chrome\\User Data", "Edge\\User Data", "BraveSoftware", "Firefox\\Profiles", "Opera Software")
| where InitiatingProcessFolderPath has_any ("\\Temp\\", "\\Roaming\\", "\\Public\\", "\\Downloads\\")
| project AccessTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath,
          InitiatingProcessCommandLine, TargetFile=FolderPath, InitiatingProcessMD5;
let HashHits = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where MD5 in~ (KnownHashes) or InitiatingProcessMD5 in~ (KnownHashes)
| project HashHitTime=TimeGenerated, DeviceName, FileName, FolderPath, MD5, InitiatingProcessCommandLine;
let WebhookExfil = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any ("discord.com/api/webhooks", "discordapp.com/api/webhooks", "api.telegram.org")
| where InitiatingProcessFileName !in~ ("discord.exe", "telegram.exe", "chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| project ExfilTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP;
BrowserStoreAccess
| join kind=leftouter WebhookExfil on DeviceName
| join kind=leftouter HashHits on DeviceName
| project DeviceName, AccessTime, InitiatingProcessFileName, InitiatingProcessFolderPath,
          TargetFile, ExfilTime, RemoteUrl, HashHitTime, MD5
| order by DeviceName asc, AccessTime desc

# Stealer Factory MaaS Infostealer - Endpoint Hunt Script
# Checks for known payload hashes, suspicious unsigned Python-compiled binaries
# in user-writable paths, webhook exfil artifacts, and persistence mechanisms.

$KnownHashes = @(
    "429ed63ab3fbda8d22d0ac750ecfe8cc",
    "610f0c65a3f8e88559f89ed90ea9ee5c",
    "9ffe0e45c7a3f20e4481206c1c3b0854"
)

Write-Host "[+] Hunting for known Stealer Factory payload hashes..." -ForegroundColor Cyan
$SearchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "C:\Users\Public", "$env:USERPROFILE\Downloads")
foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include *.exe -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($KnownHashes -contains $hash.ToLower()) {
                Write-Host "[!] KNOWN IOC HIT: $($_.FullName) [$hash]" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for unsigned executables in suspicious paths (PyInstaller/Nuitka drop zones)..." -ForegroundColor Cyan
foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include *.exe -ErrorAction SilentlyContinue | Where-Object {
            $_.LastWriteTime -gt (Get-Date).AddDays(-14)
        } | ForEach-Object {
            $sig = Get-AuthenticodeSignature -FilePath $_.FullName -ErrorAction SilentlyContinue
            if ($sig.Status -ne "Valid") {
                Write-Host "[!] Unsigned recent EXE: $($_.FullName) (Modified: $($_.LastWriteTime))" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "[+] Checking active connections to webhook endpoints..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc -and $proc.Name -notmatch "discord|telegram|chrome|msedge|firefox|brave") {
            $dns = [System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName
            if ($dns -match "discord|telegram") {
                Write-Host "[!] Suspicious webhook connection: $($proc.Name) (PID $($_.OwningProcess)) -> $dns" -ForegroundColor Red
            }
        }
    } catch {}
}

Write-Host "[+] Checking Run keys and Scheduled Tasks for persistence..." -ForegroundColor Cyan
$RunKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($Key in $RunKeys) {
    Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match "Temp|AppData|Public|Downloads" } | ForEach-Object {
            Write-Host "[!] Suspicious Run key: $($_.Name) = $($_.Value)" -ForegroundColor Yellow
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match "Temp|AppData|Public|Downloads"
} | ForEach-Object {
    Write-Host "[!] Suspicious scheduled task: $($_.TaskName) -> $($_.Actions.Execute)" -ForegroundColor Yellow
}

Write-Host "[+] Hunt complete. Investigate any hits; assume credential compromise if browser stores were accessed." -ForegroundColor Cyan