Infostealer
Creal Stealer
Creal is an open-source grabber/credential stealer that was originally made by a GitHub user named Ayhuuu, who even advertised a "premium" version on his now-deleted Telegram channel @Crealstealer.
Creal Stealer is a Python infostealer.
Background
Creal is an open-source grabber/credential stealer initially authored by a GitHub user going by Ayhuuu, who went so far as to market a "premium" edition on his since-deleted Telegram channel @Crealstealer. By the time of release it was no longer FUD, yet its open-source nature made it appealing for threat actors to alter the base malware and obfuscate it to lower detection rates. The base project shipped with a compiler that relied on PyInstaller to produce native formats such as exe. Discord webhooks served as the C2 channel, and later versions shielded these with a service at https://stealer.to to prevent their deletion.
It Compromised following Data on Execution:
- Discord Information
- Browser Data
- Crypto Related Data
- Steam
- Riot Games
- Telegram
- System Information
- Tokens/Secrets
Source: Malpedia (Fraunhofer FKIE).