Threat reportMalwareTL-2026-3866
MetaStealer Part 2: Updated Build, Layered String Decryption and Google Cookie Refresher Abuse
MetaStealer Part 2 (TL-2026-3866), also tracked as MetaStealer, is a medium-severity malware campaign, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Windows, maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 37 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-3866
- Threat ID
- TL-2026-3866
- Also known as
- MetaStealer, Meta Stealer, MetaStealer v4
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, general-consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 37
- Updates
- 2026-10-19 · revalidated 1× · latest source
Malware and tooling in MetaStealer Part 2
Malware and tooling: MetaStealer, Vidar, dnlib
How MetaStealer Part 2 works
An updated MetaStealer (.NET infostealer related to the RedLine codebase) build uses renamed classes and a layered base64 -> XOR -> base64 string decryption routine. After C2 communication it drops qemu-ga.exe into the Startup folder and exits when sandbox-associated usernames or computer names are found. The source also notes multiple stealers abusing a Google cookie-refresh mechanism for persistent account access.
MetaStealer is a .NET information stealer that emerged in 2022 and is based on the RedLine stealer codebase (Malwarebytes, NCC Group). It targets crypto wallets and online service credentials. Its C2 traffic is similar enough to RedLine that some builds were long classified as RedLine; the Emerging Threats community discussion notes ET rule 2049282 (ET MALWARE MetaStealer Activity (Response)) was released on 2023-11-22 for v3 and that a version 4 appeared in early December 2023, with some variants still detected as RedLine or only as generic Microsoft net.tcp initialization activity.
RussianPanda (@AnFam17) analyzed an updated build in 'MetaStealer Part 2' (2023-12-28/29 via mirror). Class names were renamed (e.g. from Entity to Schema/TreeObject), the binary description and icon were changed, and string encryption was reworked into a layered scheme: base64-decode, XOR with a hardcoded key (example key 'Crayfish'), then base64-decode again. The analyst used dnlib to load the .NET assembly, locate decryption methods by signature (an Int32 parameter returning System.String), extract call-site arguments and invoke the methods at runtime to recover plaintext strings. Decrypted output included a base64-encoded .NET executable, qemu-ga.exe (MD5 e6db93b513085fe253753cff76054a2a), which the sample writes to the Windows Startup folder after receiving its C2 configuration, giving persistence across reboots. The analyzed sample (MD5 a8d6e729b4911e1a0e3e9053eab2392b) communicates with C2 5.42.65.34:25530.
The sample keeps lists of suspicious usernames and computer names and terminates when one matches, to evade sandboxes. It queries WMI (ROOT\SecurityCenter: SELECT * FROM AntivirusProduct) to enumerate installed antivirus products. The article also notes that multiple stealers (Redline, Vidar, Lumma, RisePro named) abuse Google's cookie-refresh mechanism to obtain fresh cookies and keep access to Google accounts. Yara and Sigma rules were published by the author.
Distribution context: Malwarebytes (2023-12-19) documented MetaStealer malvertising campaigns running in November and December 2023 via malicious Google Ads impersonating Notepad++ and AnyDesk, with decoy/landing domains rawnotepad.com and startworkremotely.com serving zip payloads. A November variant used a PowerShell shortcut that depended on the Downloads folder path; the December variant used a recompiled malicious DLL without the PowerShell component. Malwarebytes lists nine C2 domains. No threat actor attribution is stated in the sources. Note: the original russianpanda95.github.io URL returned HTTP 404; details above were verified against the HendryAdrian mirror and a search summary, so not every claim in the original post could be independently confirmed.
MITRE ATT&CK techniques used in TL-2026-3866
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1055.012 Process Injection: Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1204.002 User Execution: Malicious File
Discovery
T1057 Process Discovery; T1083 File and Directory Discovery; T1518.001 Software Discovery: Security Software Discovery
Command and Control
T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Resource Development
Affected products and versions in MetaStealer Part 2
- Microsoft — Windows
Vulnerable versions: Windows endpoints running .NET-based malware; no product vulnerability
Remediation for MetaStealer Part 2
Immediate actions
- Block 5.42.65.34 (TCP/25530) and the MetaStealer C2/landing domains listed in IOCs at DNS and perimeter
- Hunt for qemu-ga.exe in user Startup folders (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup) on non-virtualization hosts
- On confirmed infection, reset credentials and revoke active sessions/cookies for browser-stored accounts, including Google accounts, and review crypto wallet exposure
Workarounds
- Prevent saving credentials and session data in browsers on high-risk endpoints; enforce short session lifetimes and device-bound session controls for Google Workspace
Longer-term hardening
- Restrict software installs to approved sources and filter malicious search ads for popular tools (Notepad++, AnyDesk)
- Deploy EDR with detection for unsigned .NET binaries written to Startup folders and WMI SecurityCenter queries from untrusted processes
- Deploy network signatures covering MetaStealer (e.g. ET rule 2049282) and Yara/Sigma rules published by RussianPanda
Timeline of MetaStealer Part 2
- MetaStealer first advertised (March 2022) as a RedLine-derived infostealer with additional features (day-level date approximate).
- NCC Group publishes 'Metastealer - filling the Racoon void', an early public write-up of the MetaStealer family (title and date from search results; page not fetched).
- RussianPanda publishes 'MetaStealer - Redline's Doppelganger' (Part 1), distinguishing MetaStealer from RedLine.
- Emerging Threats community post 'Meta vs Redline Stealer' confirms C2 traffic similarity and that Meta samples were misidentified as RedLine.
- Emerging Threats releases rule 2049282 'ET MALWARE MetaStealer Activity (Response)' for MetaStealer v3 traffic.
- MetaStealer updates to version 4 in early December 2023 (day-level date approximate per ET community post); some variants still detected as RedLine.
- Malwarebytes reports MetaStealer malvertising campaigns that ran in November and December 2023 using Google Ads impersonating Notepad++ and AnyDesk.
- RussianPanda's 'MetaStealer Part 2' (original dated path 2023/12/28) analyzes the updated build: layered string decryption, qemu-ga.exe Startup drop, sandbox checks, Google cookie refresher abuse.
- HendryAdrian mirrors the Part 2 analysis; original URL later returns HTTP 404.
- Operation Magnus disrupts RedLine and META: three servers shut down in the Netherlands, two domains and Telegram accounts taken down, customer database obtained; 1,200+ servers identified.
- ESET Research publishes analysis of the RedLine empire, assessing RedLine and META share the same creator.
Update history for TL-2026-3866
- 2026-10-19 — MetaStealer – RedLine's Doppelgänger: C# infostealer reusing RedLine code (disrupted in Operation Magnus, Oct 2024): What changed No field escalations applied. The report suggests HIGH severity and MONITORING status, but these reflect a different assessment of the family (post-takedown) rather than demonstrated escalation; status MONITORING would be a dow
Sources cited for MetaStealer Part 2
- MetaStealer Part 2, Google Cookie Refresher Madness and Stealer Drama (HendryAdrian mirror)
- MetaStealer Part 2 (HendryAdrian mirror, alternate link)
- MetaStealer - Redline's Doppelganger (HendryAdrian mirror of RussianPanda Part 1)
- New MetaStealer malvertising campaigns (Malwarebytes)
- Meta vs Redline Stealer (Emerging Threats community)
- Metastealer - filling the Racoon void (NCC Group)
- Venture Wolf attempts to disrupt Russian businesses with MetaStealer (BI.ZONE)
Detection coverage for TL-2026-3866
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3866 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.