Vanta Stealer: Python-Based Cross-Platform Infostealer Targets Browser Credentials, Discord Tokens & Crypto Wallets — OTX Detection Pack

3bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62
4bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabb
5dbddac39fda06acc703c22935fa24e0b4bcdbc26624a1869fe93cd568cdb9fc
6f20836eef6496695e5f2a5fd81e7dfb8770df38fb1bf67fcf024c1261352daa
09e3ce307b2af3f94a315eba97c094d8d755b3674208cc47ceab3c1630a84ad9
026c85b97a6ddac14c9835d0580228c0a82dd82ce12d8d921c2f3067a12bbb7e
31f3e50e764a090d2dbf759e6cb5f678c5c6a3a5a96ff3a2069ffda520580e52
34a01c2429161a8711adff3495ab1dee4419511c8f45c483f50ac71205f68512

---
title: Vanta Stealer - Chromium Browser Credential Database Access
id: 8f1a2b3c-vanta-0001-9d4e-5f6a7b8c9d01
status: experimental
description: Detects non-browser processes accessing Chromium-based browser credential stores (Login Data, Cookies, Local State), consistent with Vanta Stealer credential harvesting behavior
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://otx.alienvault.com
    - https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware
tags:
    - attack.credential_access
    - attack.t1555.003
logsource:
    category: file_event
    product: windows
detection:
    selection_paths:
        TargetFilename|contains:
            - '\AppData\Local\Google\Chrome\User Data\'
            - '\AppData\Local\Microsoft\Edge\User Data\'
            - '\AppData\Local\BraveSoftware\Brave-Browser\User Data\'
            - '\AppData\Roaming\Opera Software\'
    selection_files:
        TargetFilename|endswith:
            - '\Login Data'
            - '\Cookies'
            - '\Local State'
            - '\Web Data'
    filter_legit_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection_paths and selection_files and not filter_legit_browsers
falsepositives:
    - Backup software
    - Enterprise DLP agents
level: high
---
title: Vanta Stealer - Discord and Telegram Token Theft
id: 8f1a2b3c-vanta-0002-9d4e-5f6a7b8c9d02
status: experimental
description: Detects suspicious processes reading Discord Local Storage leveldb files or Telegram tdata session directories, a hallmark of token/session theft by infostealers such as Vanta Stealer
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://otx.alienvault.com
tags:
    - attack.credential_access
    - attack.t1528
    - attack.t1555
logsource:
    category: file_event
    product: windows
detection:
    selection_discord:
        TargetFilename|contains:
            - '\discord\Local Storage\leveldb'
            - '\discordcanary\Local Storage\leveldb'
            - '\discordptb\Local Storage\leveldb'
    selection_telegram:
        TargetFilename|contains:
            - '\Telegram Desktop\tdata'
    filter_legit:
        Image|endswith:
            - '\Discord.exe'
            - '\Telegram.exe'
    condition: (selection_discord or selection_telegram) and not filter_legit
falsepositives:
    - Rare third-party Discord utilities
level: high
---
title: Vanta Stealer - PyInstaller Packed Executable Spawning Suspicious Child Activity
id: 8f1a2b3c-vanta-0003-9d4e-5f6a7b8c9d03
status: experimental
description: Detects unsigned executables running from user-writable temp/AppData paths that access gaming, VPN, or crypto wallet artifact locations, matching Vanta Stealer's PyInstaller-packaged modular collection behavior
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://otx.alienvault.com
tags:
    - attack.execution
    - attack.t1059.006
    - attack.t1027
    - attack.t1005
logsource:
    category: process_creation
    product: windows
detection:
    selection_exec_paths:
        Image|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Downloads\'
            - '\Users\Public\'
    selection_targets:
        CommandLine|contains:
            - 'steam'
            - 'ssfn'
            - 'Riot Games'
            - 'Roblox'
            - 'minecraft'
            - '.minecraft'
            - 'Mullvad'
            - 'wallet.dat'
            - 'exodus'
            - 'electrum'
            - 'atomic wallet'
            - 'metamask'
    filter_signed:
        Signed: 'true'
    condition: selection_exec_paths and selection_targets and not filter_signed
falsepositives:
    - Legitimate portable utilities run from Downloads
    - Game modding tools
level: medium

// Vanta Stealer hunt: known SHA256 IOCs + behavioral access to credential stores
let VantaHashes = dynamic([
    "3bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62",
    "4bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabb",
    "5dbddac39fda06acc703c22935fa24e0b4bcdbc26624a1869fe93cd568cdb9fc",
    "6f20836eef6496695e5f2a5fd81e7dfb8770df38fb1bf67fcf024c1261352daa",
    "09e3ce307b2af3f94a315eba97c094d8d755b3674208cc47ceab3c1630a84ad9",
    "026c85b97a6ddac14c9835d0580228c0a82dd82ce12d8d921c2f3067a12bbb7e",
    "31f3e50e764a090d2dbf759e6cb5f678c5c6a3a5a96ff3a2069ffda520580e52",
    "34a01c2429161a8711adff3495ab1dee4419511c8f45c483f50ac71205f68512"
]);
let StealerTargets = dynamic([
    "Login Data", "Local State", "\\Cookies",
    "\\discord\\Local Storage\\leveldb", "\\Telegram Desktop\\tdata",
    "ssfn", "\\.minecraft\\", "Mullvad", "wallet.dat", "metamask", "exodus", "electrum"
]);
let HashHits = DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in~ (VantaHashes)
    | project HitType="KnownHashExecution", TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine;
let BehaviorHits = DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FileName has_any (StealerTargets) or FolderPath has_any (StealerTargets)
    | where not(InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","brave.exe","opera.exe","Discord.exe","Telegram.exe","Steam.exe"))
    | where InitiatingProcessFolderPath has_any ("\\Temp\\","\\Downloads\\","\\AppData\\Roaming\\","\\Users\\Public\\")
    | project HitType="CredentialStoreAccess", TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath;
union HashHits, BehaviorHits
| sort by TimeGenerated desc

# Vanta Stealer Endpoint Hunt — run via EDR Live Response / RMM across fleet
# Checks for known hashes, suspicious access artifacts, and staged exfil archives

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

$vantaHashes = @(
    '3bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62',
    '4bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabb',
    '5dbddac39fda06acc703c22935fa24e0b4bcdbc26624a1869fe93cd568cdb9fc',
    '6f20836eef6496695e5f2a5fd81e7dfb8770df38fb1bf67fcf024c1261352daa',
    '09e3ce307b2af3f94a315eba97c094d8d755b3674208cc47ceab3c1630a84ad9',
    '026c85b97a6ddac14c9835d0580228c0a82dd82ce12d8d921c2f3067a12bbb7e',
    '31f3e50e764a090d2dbf759e6cb5f678c5c6a3a5a96ff3a2069ffda520580e52',
    '34a01c2429161a8711adff3495ab1dee4419511c8f45c483f50ac71205f68512'
)

# 1. Hash sweep of high-risk drop locations
$dropPaths = @("$env:TEMP", "$env:LOCALAPPDATA\Temp", "$env:USERPROFILE\Downloads",
               "$env:APPDATA", "C:\Users\Public")
foreach ($path in $dropPaths) {
    Get-ChildItem -Path $path -Recurse -Include *.exe -File | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($vantaHashes -contains $h) {
            $report += [pscustomobject]@{Finding='KNOWN_VANTA_HASH'; Path=$_.FullName; Hash=$h}
        }
    }
}

# 2. Recently-created archives in user dirs (infostealer staging behavior)
$staging = Get-ChildItem "$env:TEMP","$env:USERPROFILE\Documents","$env:USERPROFILE\Desktop" -Recurse `
    -Include *.zip,*.rar,*.7z -File | Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) }
foreach ($s in $staging) {
    $report += [pscustomobject]@{Finding='SUSPECT_STAGING_ARCHIVE'; Path=$s.FullName; Hash='-'}
}

# 3. Unsigned PyInstaller-style binaries running from user-writable paths
Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match '\\(Temp|Downloads|AppData\\Roaming|Users\\Public)\\' -and
    $_.ExecutablePath -like '*.exe'
} | ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.ExecutablePath
    if ($sig.Status -ne 'Valid') {
        $report += [pscustomobject]@{Finding='UNSIGNED_USERDIR_PROCESS'; Path=$_.ExecutablePath; Hash=(Get-FileHash $_.ExecutablePath).Hash}
    }
}

# 4. Python interpreter presence on endpoints where it shouldn't be
Get-CimInstance Win32_Process -Filter "Name like '%python%'" | ForEach-Object {
    $report += [pscustomobject]@{Finding='PYTHON_PROCESS_RUNNING'; Path=$_.ExecutablePath; Hash='-'}
}

# 5. Network connections from processes in user-writable paths
Get-NetTCPConnection -State Established | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess
    if ($p.Path -match '\\(Temp|Downloads|AppData\\Roaming|Users\\Public)\\') {
        $report += [pscustomobject]@{Finding="OUTBOUND_$($_.RemoteAddress):$($_.RemotePort)"; Path=$p.Path; Hash='-'}
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv "C:\vanta_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Host "[+] Hunt complete: $($report.Count) findings on $env:COMPUTERNAME"