---
title: "Infostealer Comparison: Top Stealers in 2022"
description: An infostealer attack can be extremely damaging—and attacks are on the rise. Morphisec analyzes six of the top infostealers used in 2022.
image: https://blog.morphisec.com/hubfs/shutterstock_1092152978.jpg
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Your Guide to Top Infostealers in 2022

Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on July 6, 2022

- [Tweet](https://twitter.com/share)

To help protect the public, Morphisec Labs constantly monitors, investigates, and assesses the latest threats to help organizations avoid serious consequences. In recent months, threats involving infostealers have escalated. This report analyzes six of the top infostealers used this year.

An infostealer is a piece of malware that tries to steal your information, usually to make money from it. Threat actors often try to blackmail the victim, or just sell their stolen information on dark web forums or the black market. Standard infostealers steal login info like usernames and passwords, while more advanced infostealers (called keyloggers) can record every keystroke in your system. Infostealers usually email their stolen info to another system, or send it over a network.

Infostealers are often sold on dark web forums and as Malware-as-a-Service (MaaS). Threat actors typically use browser extensions, exploited websites, malicious attachments, and Google ads to deliver infostealers to their victims. (Morphisec’s revolutionary [Moving Target Defense](https://www.morphisec.com/moving-target-defense) (MTD) technology effectively prevents these types of attacks.) 

[![Zero Trust and Moving Target Defense](https://blog.morphisec.com/hubfs/moving-target-defence-ebook-large%20(1).png)](https://engage.morphisec.com/the-ultimate-ransomware-strategy?hsCtaTracking=cee53a50-a567-48e7-9b2c-d07668821c9c%7C8b7e05da-099f-4b06-b54f-04f732d8adf5)

 

## 2022 Information Stealer Comparison

We arranged information stealers into comparable modules according to their characteristics and capabilities. This way we can more clearly see the differences and improvements offered by each stealer. The table below summarizes our finding while researching each of the stealers:

| **Family** | Raccoon V1 | RedLine Stealer | Mars Stealer | Raccoon V2 | BlackGuard | Jester Stealer |
| --- | --- | --- | --- | --- | --- | --- |
| **First seen** | 2019 | 2020 | 2021 | 2022 | 2021 | 2021 |
| **Price** | $75/7 days $200/30 days | $150/month | $140/month | $275/month | $200/month | $99/month |
| **Programming Language** | C\\C++ | C# (.NET) | C\\C++ | C\\C++ | C# (.NET) | C# (.NET) |
| **Anti-**[**CIS**](https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States)** (Country Whitelisting)** | **Supported.** Stops if victim’s machine is in a post-Soviet (CIS) state. | **Supported.** Custom blacklist. | **Supported.** Stops if victim’s machine is in a post-Soviet (CIS) state. | **Not Supported.** Looks for “ru” but doesn’t do anything if found. | **Supported.** Stops if victim’s machine is in a post-Soviet (CIS) state. | **Not Supported.** |
| **Mutex Creation** | **Supported.** Hard-coded name | **Not Supported.** | **Supported.** Hard-coded name | **Supported.** Hard-coded name | **Not Supported.** | **Supported.** Based on machine properties |
| **Additional DLLs** | Zip file of many DLLs | No need for additional DLLs. | sqlite3.dll, freebl3.dll, mozglue.dll, msvcp140.dll, nss3.dll, softokn3.dll, vcruntime140.dll | sqlite3.dll, freebl3.dll, mozglue.dll, msvcp140.dll, nss3.dll, softokn3.dll, vcruntime140.dll and nssdbm3.dll (not found) | SQLite.Interop.dll | **Not Supported. **No need for additional DLLs. |
| **C2 Communication** | Direct communication through HTTP | Direct communication through WCF | Direct communication through HTTP | Direct communication through HTTP | Communication via Telegram API | Communication via Tor proxy or Upload to AnonFiles |
| **System Information Module** | **Supported.** | **Supported.** | **Supported.** | **Supported.** | **Supported.** | **Supported.** |
| **Screenshot** | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Supported.** Embedded configuration. | **Supported.** Configured by the server. | **Supported.** Embedded configuration. | **Supported.** Embedded configuration. |
| **Browsers Data Module** | **Supported.** Embedded configuration. | **Supported.** Configured by the server. | **Supported.** Embedded configuration. | **Supported.** Embedded configuration. | **Supported.** Embedded configuration. | **Supported.** Embedded configuration. |
| **Extensions Module** | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Supported.** Embedded configuration. | **Supported.** Configured by the server. | **Supported.** Embedded configuration. | **Supported.** Embedded configuration. |
| **Crypto Wallets Module** | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Supported.** Embedded configuration. | **Supported.** Configured by the server. | **Supported.** Embedded configuration. | **Supported.** Embedded configuration. |
| **Grabber Module** | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Supported.** Embedded configuration. | **Supported.** Embedded configuration. |
| **Loader Module** | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Supported.** Configured by the server. | **Not Supported.** | **Not Supported.** |
| **Applications Data Module** | Not Supported. | **Supported.** Steals Telegram, Discord, and Steam data. | **Supported.** Steals Telegram data. | **Supported.** Steals Telegram data. | **Supported.** Steals Telegram, Discord, Pidgin, and more. | **Supported.** Steals Telegram, Discord, Pidgin, and more. |
| **Exfiltration method** | New folder is created and zipped before exfiltration. | **Not Supported.** Fileless data exfiltration. | New folder is created and zipped before exfiltration. | Fileless data exfiltration. | New folder is created and zipped before exfiltration. | New folder is created and zipped before exfiltration. |
| **Self Removal** | **Supported.** | **Not Supported.** | **Supported.** | **Not Supported.** | **Not Supported.** | **Supported.** |

Next we provide a high-level overview of each stealer along with links to more in-depth analysis. 

## Mars Stealer

**![MarsStealer](https://www.morphisec.com/hubfs/MarsStealer.png)***Translation of a Mars stealer post on a hacking forum*

The Mars stealer first showed up for sale on hacking forums in July, 2021. It was later revealed to be derived from the Arkie stealers such as the Vidar and Oski stealers. Mars is improved over its predecessor, the Oski stealer, and continues to improve with each update. Morphisec covered the [latest campaign](https://blog.morphisec.com/threat-research-mars-stealer) to distribute the Mars stealer, which uses SEO techniques and fake websites that lure victims to download the malicious fake installer.

This malware can steal:

- Browser private information: profiles, auto fill information, credentials, cookies, and more
- Browser extensions including crypto wallet and 2FA extensions
- Crypto wallet software configuration information and wallet data
- Grabber functionality that steals whole files according to controlled regex
- On newer versions, data from instant messaging service Telegram
- Screenshot upon infection

This malware also has a Loader module enabling it to execute additional malware and additional commands.

![MarsStealer2](https://www.morphisec.com/hubfs/MarsStealer2.png)* Folder containing stolen data*

**Price:**

Standard version: $140/month 

Extended version: $160/month

In-depth analysis of the Mars stealer can be found [here](https://3xp0rt.com/posts/mars-stealer) and [here](https://x-junior.github.io/malware%20analysis/MarsStealer/). 

## Raccoon Stealer

![Raccoon Stealer](https://www.morphisec.com/hubfs/Raccoon%20Stealer.png)

*Translation of the first sale post for the Raccoon stealer*

The Raccoon stealer was first observed in April 2019. Similar to Mars, Raccoon steals profiles, auto fill info, credentials, cookies, system information, browser extension data, crypto wallet data, etc.

The story of the Raccoon stealer took a turn in March 2022. After a key developer died in the Russian invasion of Ukraine, the people behind Raccoon suspended all activity.

![Raccoon Stealer2](https://www.morphisec.com/hubfs/Raccoon%20Stealer2.png)*Translation of post advising all Raccoon stealer activities are suspended*

However, the S2W blog [reported](https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d) Raccoon has now developed a new version, released on June 9 2022, that offers new functionality:

- **New configuration format**

Morphisec Threat Labs found the new Raccoon stealer to be very similar in functionality to other stealers derived from the Arkie stealer, such as the Mars stealer.

The Vidar, Oski, and Mars stealers are loaded with the following additional, legitimate DLLs:

- *freebl3.dll*
- *mozglue.dll*
- *msvcp140.dll*
- *nss3.dll*
- *softokn3.dll*
- *vcruntime140.dll*
- *sqlite3.dll*

Each of these was downloaded from a separate link. However, the first version of Raccoon, which also required additional, legitimate DLLs, downloaded a zip file containing many more DLLs:

![Raccoon Stealer3](https://www.morphisec.com/hubfs/Raccoon%20Stealer3.png)*DLLs downloaded by Raccoon Stealer V1*

The Raccoon stealer V2 offers the same DLL loading as the Vidar, Oski, and Mars stealers:

![Racoon Stealer4](https://www.morphisec.com/hubfs/Racoon%20Stealer4.png)*DLLs downloaded by the Raccoon stealer V2*

As mentioned, the Raccoon Stealer V2 has a new module that, like the Mars stealer, steals Telegram data.

![Racoon Stealer 5](https://www.morphisec.com/hubfs/Racoon%20Stealer%205.png)*The Telegram module’s configuration*

The configuration’s value is split by “|” and represents:

1. A Telegram folder
2. Regex for files to look for
3. Regex for files to ignore

This raises the question: Are these two stealer operators connected? Perhaps sharing code bases or knowledge? The answer will likely remain unresolved.

An in-depth analysis of the Raccoon stealer can be found [here](https://blog.cyble.com/2021/10/21/raccoon-stealer-under-the-lens-a-deep-dive-analysis/) and [here](https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d). 

## RedLine Stealer

![RedLine1](https://www.morphisec.com/hubfs/RedLine1.png)

*Translation of the first sale post for the RedLine Stealer*

The RedLine stealer was first observed in hacking forums on February 19, 2020. Its reputation and popularity have risen considerably since then—it’s now one of the most popular and widely recommended information stealers on the market. (Threat actors have used [Google PPC ads to distribute it](https://1534169.hs-sites.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers).) RedLine stealer is written in C# and continues to be updated by its operators, with the latest version, v23.1, released on May, 9, 2022. RedLine is capability- and feature-rich, which explains why it’s so widely used. Features include:

- System information collection
- Anti-analysis techniques
- Collection of browser information and extension data such as passwords, autofills, etc.
- Collection of crypto wallet data from disk and browser extensions
- Collection of FTP and IM clients data 
- Collection of files from application such as Telegram, Discord, Steam, and VPNs
- Grabber module for stealing files according to white- and black-lists

**Price:**

Lite version: $150/month

Pro version: $900/lifetime

An in-depth analysis of the RedLine stealer can be found [here](https://muha2xmad.github.io/malware-analysis/fullredline/).

## BlackGuard Stealer

![BlackGuard1](https://www.morphisec.com/hubfs/BlackGuard1.png)

*Translation of the first sale post for the BlackGuard stealer*

BlackGuard is an info stealer written in C#. It first appeared and sold on the black market in March 2021. There have been several versions since then, with the latest released in March 2022. The BlackGuard authors admitted it’s a fork of the open source information stealers[![](https://lh4.googleusercontent.com/3g0KBcMVYhvOnMGfHq_TWM4gfx_AQeBopmWt4yj32zfEKqxa3FL0hRGJXhRbCpK-QQ_aRsIQhRW--R2yctF60wFxr3LlRRbToCUayfTruRYfnrRjL6gk5IBGcAEyNKIia8wYu3YC7aIZGnm3KA)StormKitty](https://github.com/swagkarna/StormKitty) and[![](https://lh4.googleusercontent.com/VUBp72xYmgWAaTAufoRZOBjjmFSy6ZhUfehE7RNGdsH910mXWvrQec7E7sZMU1w_cnGvhxj8-g5Wdv69XOGzL9hsf6v6Ab3xogHcM8i05A4aZNhnXaJI5L5sWwSykMpg1iBQBTwzOnDsQ_1CVw)44CALIBER](https://github.com/razexgod/44CALIBER). They took parts from each project and added new functionality, resulting in the BlackGuard stealer. For example, the exfiltration module is taken from StormKitty via Telegram, rather than from 44Caliber via Discord.

The BlackGuard team doesn’t offer distribution for their malware, so buyers must choose their own method of distribution. The latest examples for delivering this stealer include: cracked software, fake Windows updates,[YouTube videos](https://asec.ahnlab.com/en/32499/), etc. 

BlackGuard capabilities include:

- Collects user data from Telegram, Discord, and Steam
- Collects sensitive data from FTP and VPN applications
- Collects private browser information: passwords, auto fill information, cookies, and history
- Collects crypto wallet software configuration information and wallet data
- Grabber functionality for specific file types in specific paths
- Collects the infected machine’s information

BlackGuard stores its stolen information in a folder named ChikenDir, compresses the folder, and exfiltrates the folder via a Telegram API.

**Price:**

One month: $200

Lifetime subscription: $700

An in-depth analysis of the BlackGuard stealer can be found [here](https://www.zscaler.com/blogs/security-research/analysis-blackguard-new-info-stealer-malware-being-sold-russian-hacking).

## Jester Stealer

![Jester1](https://www.morphisec.com/hubfs/Jester1.png)

*The first sale post for the Jester Stealer*

The Jester stealer was first introduced in July 2021 and has received several updates since then. The latest update occurred in January 2022 and features bug fixes and improvements.

![Jester2](https://www.morphisec.com/hubfs/Jester2.png)

*A post on the Jester Stealer’s official Telegram channel*

The Jester stealer was recently used in a campaign against[Ukrainian entities](https://cert.gov.ua/article/40135). It was distributed via Malspam with a “chemical attack” theme that lured victims to download an Excel document. Once the document is downloaded, opened, and the user activates a macro, the Jester Stealer is downloaded and executed.

The stealer is written in C# and, per their message, offers the following functionality:

- Collection of browser data: passwords, CC, cookies, Autofill info, history, bookmarks from 20+ browsers
- Session and sensitive files from messenger apps such as: Telegram, Discord, Pidgin, etc.
- Collects info from cryptocurrency extensions
- Collects info from gaming software sessions: Steam, Twitch, etc.
- Collects info from password managers: LastPass, KeePass, BitWarden, etc.
- Collects info from VPN and FTP clients

**Price:**

One month: $99

Lifetime subscription: $249

An in-depth analysis of the Jester stealer can be found [here](https://blog.cyble.com/2022/02/24/jester-stealer-an-emerging-info-stealer/).

## Don’t Let an Infostealer Compromise Your Network

Infostealer attacks are increasing and can be extremely damaging to any organization. This post examined six of the more threatening and dangerous ones. An infostealer is often used as the first step in an attack chain that can lead to ransomware and other extremely damaging threats. 

Morphisec’s Moving Target Defense (MTD) technology is designed to prevent these types of attacks, stopping them before they can cause financial impacts, lawsuits, and brand damage. To learn more about Morphisec MTD for endpoints and servers, read the white paper,  [Zero Trust + Moving Target Defense: The Ultimate Ransomware Strategy](https://engage.morphisec.com/the-ultimate-ransomware-strategy). 

![Zero Trust + Moving Target Defense  = The Ultimate Ransomware Strategy white paper](https://lh6.googleusercontent.com/KKL2HkYyszlP2f0LG44L6aiMgYgi0zQaUvBUlqkd8FtIbNQx9EPFpDctad6nma1j1t_0jS28BzTpT7T-7XdXKTAQ4k9NxQzuLYQOTJZC1hzgKuBX93_SN0UyRSfhYEqb28Dxm4o0UVF0LFRzJd0)

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/infostealer-comparison#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Morphisec Labs",
    "url" : "https://1534169.hs-sites.com/author/morphisec-labs"
  },
  "dateModified" : "2023-07-03T12:51:34.783Z",
  "datePublished" : "2022-07-06T14:09:36.000Z",
  "headline" : "Infostealer Comparison: Top Stealers in 2022",
  "image" : [ "https://blog.morphisec.com/hubfs/shutterstock_1092152978.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/infostealer-comparison",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```