# RootTeam Stealer and overlap issues on Bandit Stealer rule detection **URL:** \ **Category:** Rule Signatures\ **Created:** [July 11, 2023, 8:51am UTC](https://community.emergingthreats.net/t/rootteam-stealer-and-overlap-issues-on-bandit-stealer-rule-detection/744 "2023-07-11T08:51:49Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![g0njxa](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/g0njxa/32/364_2.png) [@g0njxa](https://community.emergingthreats.net/u/g0njxa)\ **Post date:** [August 17, 2023, 5:10pm UTC](https://community.emergingthreats.net/t/rootteam-stealer-and-overlap-issues-on-bandit-stealer-rule-detection/744/3 "2023-08-17T17:10:32Z")
a new variant has discovered of this stealer, currently there’s no rule detection. CnC exfil changed now log is being uploaded as base64 in a single request. I dont know why 2046806 - Win32/RootTeam Stealer CnC Exfil M2. # Detects POST to /api/report is not being pushed OLD: [Analysis Launcher.exe (MD5: 525ECA0E85C3325ECA5B5B3CFEACD241) Malicious activity - Interactive analysis ANY.RUN](https://app.any.run/tasks/da0c4adf-53e7-484f-bad6-e643fd513a8b/) NEW: [Analysis LaLauncher.exe (MD5: 43A3997C24E25E4B25F66AFF503ACE89) Malicious activity - Interactive analysis ANY.RUN](https://app.any.run/tasks/616ca90b-9f70-4d8c-ab9b-68ae70ab65d2) the other PE file being dropped by this stealer is a clipper that now is being loaded by the new variants too --- _[View the full topic](https://community.emergingthreats.net/t/rootteam-stealer-and-overlap-issues-on-bandit-stealer-rule-detection/744)._