MythStealer: Browser and Discord Credential Theft with HTTPS Exfiltration to Operator-Notified C2

Overview

The Sonicwall Threats research team have recently been tracking an information-stealer malware family known as Myth. The sample we analyzed is a 43.8 MB Windows executable combining browser credential theft, Discord session token extraction, Firefox cookie harvesting, and HTTPS exfiltration into a single binary. The payload is written in Rust, packed with a custom in-memory loader (mexec), and carries an inner PE protected by Themida. The inner payload is XOR-encrypted via the include-crypt-crypto Rust crate and decrypted entirely in memory — nothing is written to disk beyond a small NSIS scratch file.

The stealer targets 27 Chromium-based browser profiles, four Discord client variants, and Firefox cookies. Stolen data is packaged as a ZIP and POSTed over HTTPS to myth.cocukporno.lol — a C2 belonging to the MythStealer family, advertised on Telegram at t.me/mythstealerx. A separate POST delivers a victim summary including machine name, external IP, cookie count, and Microsoft account MFA status to the operator.

Runtime behavior was captured using a custom kernel-mode hooking driver that instruments API calls at the point of execution, producing full hooklogs of the execution chain without modifying the sample on disk.

Infection Cycle

Stage 1 — Loader and In-Memory Execution

The outer binary is an NSIS installer. It drops a small scratch file to %TEMP% and reflectively loads the inner payload via the mexec Rust crate — no second-stage PE touches disk. The inner PE has a .themida section (54 MB virtual) and a .boot stub. The .rdata section measures 7.95 bits/byte entropy, consistent with the XOR encryption scheme used by include-crypt-crypto 0.1.0.

The developer's PDB path is embedded in the binary, revealing the loader crate name and the author's username:

Stage 2 — Anti-Analysis Checks

Timing gate: Two back-to-back GetTickCount calls measure elapsed time and act as a timing gate. Under hook overhead the delta approaches 94ms, triggering self-termination with a STATUS_DLL_INIT_FAILED (0xc0000142) fake status. In our environment we spoofed the delta to 1ms to pass the check:

Virtualisation probes: Numerous NtCreateFile calls attempt to open known VMware and VirtualBox DLLs using CreateDisposition=0x1 (open-existing only). No file is created — the return code alone reveals the environment:

Registry checks: The safe-boot key is queried to detect sandboxed environments. An IFEO self-check detects debuggers attached via Image File Execution Options:

Stage 3 — Chromium Credential and Cookie Theft

The stealer enumerates 27 Chromium profile paths, reading Local Storage\leveldb\ for session tokens and Local State for the DPAPI-protected AES master key. For Chrome 127+ the App-Bound Encryption COM interface is attempted; older profiles fall back to CryptUnprotectData. After AES-GCM decryption of the master key, Login Data and Web Data SQLite databases are opened for passwords and autofill.

Stage 4 — Discord Token Extraction

For all four Discord clients (Stable, Canary, PTB, Lightcord), the stealer reads LevelDB log files directly to locate v10-prefixed AES-GCM encrypted tokens. The token is decrypted using the same BCrypt AES key extracted from Local State. Successful decryption was confirmed by the TLS plaintext capture, which showed the ; Domain=discord cookie suffix in the decrypted output.

After extraction the token is validated against discord.com/api/v9/users/@me before being included in the exfil ZIP.

Stage 5 — Firefox Cookie Theft

Firefox cookies are extracted by reading cookies.sqlite directly and querying the moz_cookies table. The captured exfil ZIP contained 204 bytes of tab-separated cookie data. The format is host / httpOnly / path / secure / expiry / name / value:

Stage 6 — Victim Fingerprinting

Before exfiltration the malware performs an HTTP GET to api.ipify.org to obtain the victim's external IP address. This IP is embedded in the operator notification and used to key the live screenshot endpoint on the C2.

Stage 7 — C2 Exfiltration

All collected data is packaged into a ZIP archive (STORED compression, no password) and POSTed to myth.cocukporno.lol/f over HTTPS. A hardcoded authentication header myth-key: MYTHX-DB28229E-1WWW is included in every request. TLS plaintext was recovered by hooking BCryptEncrypt on the outbound data before TLS encryption:

The exfil ZIP contained:

Stage 8 — Operator Notification

A second POST to myth.cocukporno.lol/e sends a Discord-embed-format JSON payload to the operator. It includes machine name, stolen cookie/password counts, external IP, a live screenshot URL keyed to the victim's IP, and the target's Microsoft account MFA status:

When C2 TLS fails, the malware posts Rust panic output to a Discord webhook operated by the author. The webhook (ptb.discord.com/api/webhooks/1358142755066478743/...) has since been deleted, returning {"code": 10015}.

Stage 9 — Screenshot Capture and Exfiltration

The malware captures a screenshot of the victim's desktop using the Windows GDI API entirely in memory — no image file is written to disk. Static analysis confirms imports of BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, and CreateDIBSection. Runtime capture was confirmed by the GetDC hook firing during the stealer's execution:

The captured image is not included in the exfil ZIP sent to /f. Instead, the operator notification (Figure 12) includes a URL pointing to a dedicated screenshot endpoint on the C2 server indexed by the victim's external IP:

Indicators of Compromise

Network

File

Strings and Code

Sonicwall Protection

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: Myth.STL (Trojan)

This threat is also detected by SonicWall Capture ATP with RTDMI™ and the Capture Client endpoint solution.