# StealC Stealer

**URL:** <https://community.emergingthreats.net/t/stealc-stealer/856>\
**Category:** Rule Signatures\
**Created:** [August 10, 2023, 8:29pm UTC](https://community.emergingthreats.net/t/stealc-stealer/856 "2023-08-10T20:29:17Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [August 11, 2023, 5:07am UTC](https://community.emergingthreats.net/t/stealc-stealer/856/3 "2023-08-11T05:07:27Z")

</div>

> [@Mystic Stealer signature](https://community.emergingthreats.net/t/mystic-stealer-signature/658):
>
> Mystic Stealer C2 key exchange. alert tcp $HOME\_NET any -\> $EXTERNAL\_NET any (msg:"ET MALWARE Mystic Stealer C2 Client Hello Packet"; flow:established,to\_server; flowbits:set, mystic\_stealer\_conn\_init; flowbits:noalert; dsize:4; content:"|b5 19 6f 94|"; fast\_pattern; reference:md5,df80b1e50cfebb0c4dbf5ac51c5d7254; reference:url,inquest.net/blog/2023/06/15/mystic-stealer-new-kid-block; reference:url,www.zscaler.com/blogs/security-research/mystic-stealer; classtype:trojan-activity; sid:9999990; r…

---

_[View the full topic](https://community.emergingthreats.net/t/stealc-stealer/856)._