# MetaStealer Part 2: Updated Build, Layered String Decryption and Google Cookie Refresher Abuse

> An updated MetaStealer (.NET infostealer related to the RedLine codebase) build uses renamed classes and a layered base64 -> XOR -> base64 string decryption routine. After C2 communication it drops qemu-ga.exe into the Startup folder and exits when sandbox-associated usernames or computer names are found. The source also notes multiple stealers abusing a Google cookie-refresh mechanism for persistent account access.

- **Published:** 2026-10-19T08:35:37Z
- **Last reviewed:** 2026-10-19T09:31:36.570Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3866
- **ID:** TL-2026-3866
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MetaStealer is a .NET information stealer that emerged in 2022 and is based on the RedLine stealer codebase (Malwarebytes, NCC Group). It targets crypto wallets and online service credentials. Its C2 traffic is similar enough to RedLine that some builds were long classified as RedLine; the Emerging Threats community discussion notes ET rule 2049282 (ET MALWARE MetaStealer Activity (Response)) was released on 2023-11-22 for v3 and that a version 4 appeared in early December 2023, with some variants still detected as RedLine or only as generic Microsoft net.tcp initialization activity.

RussianPanda (@AnFam17) analyzed an updated build in 'MetaStealer Part 2' (2023-12-28/29 via mirror). Class names were renamed (e.g. from Entity to Schema/TreeObject), the binary description and icon were changed, and string encryption was reworked into a layered scheme: base64-decode, XOR with a hardcoded key (example key 'Crayfish'), then base64-decode again. The analyst used dnlib to load the .NET assembly, locate decryption methods by signature (an Int32 parameter returning System.String), extract call-site arguments and invoke the methods at runtime to recover plaintext strings. Decrypted output included a base64-encoded .NET executable, qemu-ga.exe (MD5 e6db93b513085fe253753cff76054a2a), which the sample writes to the Windows Startup folder after receiving its C2 configuration, giving persistence across reboots. The analyzed sample (MD5 a8d6e729b4911e1a0e3e9053eab2392b) communicates with C2 5.42.65.34:25530.

The sample keeps lists of suspicious usernames and computer names and terminates when one matches, to evade sandboxes. It queries WMI (ROOT\SecurityCenter: SELECT * FROM AntivirusProduct) to enumerate installed antivirus products. The article also notes that multiple stealers (Redline, Vidar, Lumma, RisePro named) abuse Google's cookie-refresh mechanism to obtain fresh cookies and keep access to Google accounts. Yara and Sigma rules were published by the author.

Distribution context: Malwarebytes (2023-12-19) documented MetaStealer malvertising campaigns running in November and December 2023 via malicious Google Ads impersonating Notepad++ and AnyDesk, with decoy/landing domains rawnotepad.com and startworkremotely.com serving zip payloads. A November variant used a PowerShell shortcut that depended on the Downloads folder path; the December variant used a recompiled malicious DLL without the PowerShell component. Malwarebytes lists nine C2 domains. No threat actor attribution is stated in the sources. Note: the original russianpanda95.github.io URL returned HTTP 404; details above were verified against the HendryAdrian mirror and a search summary, so not every claim in the original post could be independently confirmed.

## MITRE ATT&CK

- T1583.008 Acquire Infrastructure: Malvertising
- T1204.002 User Execution: Malicious File
- T1047 Windows Management Instrumentation
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1518.001 Software Discovery: Security Software Discovery
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1071 Application Layer Protocol
- T1055.012 Process Injection: Process Hollowing
- T1113 Screen Capture
- T1005 Data from Local System
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1552.001 Unsecured Credentials: Credentials In Files
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel

## Sources

- [MetaStealer Part 2, Google Cookie Refresher Madness and Stealer Drama (HendryAdrian mirror)](https://www.hendryadrian.com/metastealer-part-2-google-cookie-refresher-madness-and-stealer-drama/)
- [MetaStealer Part 2 (HendryAdrian mirror, alternate link)](https://www.hendryadrian.com/?p=9407)
- [MetaStealer - Redline's Doppelganger (HendryAdrian mirror of RussianPanda Part 1)](https://www.hendryadrian.com/?p=9419)
- [New MetaStealer malvertising campaigns (Malwarebytes)](https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns)
- [Meta vs Redline Stealer (Emerging Threats community)](https://community.emergingthreats.net/t/meta-vs-redline-stealer/1141/1)
- [Metastealer - filling the Racoon void (NCC Group)](https://research.nccgroup.com/2022/05/20/metastealer-filling-the-racoon-void/)
- [Venture Wolf attempts to disrupt Russian businesses with MetaStealer (BI.ZONE)](https://bi.zone/eng/expertise/blog/venture-wolf-ispolzuet-metastealer-v-atakakh-na-rossiyskie-kompanii/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3866