Maranhão Stealer shows how infostealers evade detection on Windows

At a glance

What this is: This is a detection-focused analysis of Maranhão Stealer, a Windows infostealer that uses trojanised installers, evasion, and persistence to harvest browser credentials, cookies, and wallet data.

Why it matters: It matters to IAM and security teams because infostealers often convert endpoint compromise into identity compromise by stealing browser sessions, secrets, and privileged access tokens that bypass normal authentication controls.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read Wazuh's detection guide for Maranhão Stealer behaviour on Windows

Context

Maranhão Stealer sits in the infostealer category: malware that focuses on stealing credentials, cookies, wallet data, and other reusable access material rather than encrypting files or causing noisy disruption. That makes it especially relevant to identity security because a single infected endpoint can expose both human sessions and non-human secrets that later drive secondary compromise.

Wazuh frames the problem as one of early detection on Windows endpoints, using Sysmon telemetry, custom rules, and SCA checks to surface the malware's characteristic behaviour. The starting position is typical of modern infostealer campaigns: low-friction delivery, credential theft, and evasive persistence aimed at turning a local infection into broader account abuse.

Key questions

Q: What breaks when an infostealer reaches a user endpoint?

A: An infostealer turns a workstation into an identity extraction point. It can steal browser credentials, session cookies, and locally stored secrets before authentication controls detect misuse. That means the compromise often shows up later as account takeover, cloud access abuse, or financial theft rather than as an obvious workstation-only incident.

Q: Why do infostealers create such high identity risk?

A: They harvest reusable access material instead of forcing a new login. Cookies, saved passwords, tokens, and secrets often outlive the malware event itself, so the attacker can reuse them from elsewhere. This is why identity teams need to treat endpoint compromise as a direct threat to session and secret integrity.

Q: How do security teams detect hidden persistence in Windows malware?

A: Correlate suspicious file paths, hidden-file changes, registry Run key edits, and unusual process trees. A single indicator is often weak, but a cluster of masquerading behaviour, persistence creation, and host discovery is much stronger. Behavioural correlation is more reliable than signature matching for commodity infostealers.

Q: Who is accountable when stolen credentials are reused for follow-on attacks?

A: Accountability sits with both the identity owner and the organisation's access governance process. If compromised accounts are not quickly contained, reviewed, and offboarded from risky entitlements, stolen credentials can be reused by the original actor or sold onward, creating secondary abuse that is preventable with lifecycle control.

Technical breakdown

Trojanised installers and reflective DLL loading

Maranhão Stealer is delivered through cracked software and modified game installers, a common social engineering pattern that exploits user trust rather than software flaws. Once executed, the malware uses suspicious double .tmp paths and reflective DLL loading through isdecmp.dll, which allows code to run from memory and complicates file-based detection. This reduces the value of static signature checks and makes process lineage, load events, and command-line anomalies more important for defenders. In practical terms, endpoint telemetry must look for execution patterns, not just known file hashes.

Practical implication: monitor process creation, module loading, and abnormal file paths together because file-only controls will miss this delivery pattern.

Registry persistence, hidden files, and system fingerprinting

After execution, the malware creates a Run key entry for updater.exe, hides files with attrib.exe +h +s, and collects system details through wmic and PowerShell. These are not random behaviours. They show the malware trying to survive reboot, reduce visibility, and profile the host before deciding what to steal or how to adapt. The combination of registry persistence and local reconnaissance is a strong indicator of a credential-harvesting workflow rather than a one-off nuisance process. Detection therefore depends on correlating persistence artefacts with host discovery commands.

Practical implication: alert on Run key changes, hidden-file attribute changes, and host enumeration commands as a single suspicious cluster.

Why SCA matters after the initial compromise

Wazuh's SCA approach looks for artefacts such as the Microsoft Updater directory, updater.exe, and crypto.key on disk. That matters because once an infostealer lands, defenders need both behaviour-based detection and state-based confirmation of compromise. Behaviour rules identify the infection path, while configuration assessment can confirm whether malicious artefacts remain present and whether cleanup actually removed the persistence foothold. For defenders, this is the difference between seeing an incident and proving containment.

Practical implication: use SCA to validate eradication after alerting, not as a substitute for behavioural detection.

Threat narrative

Attacker objective: The attacker wants reusable access material, system intelligence, and wallet data that can be monetised or used for follow-on compromise.

1. Entry occurs when the victim runs a pirated application or trojanised game installer that silently drops Maranhão Stealer on a Windows endpoint.
2. Credential harvesting follows as the malware collects browser credentials, cookies, wallet data, and system information while hiding its files and processes.
3. Impact is achieved when stolen credentials and session material can be reused for account takeover, financial theft, or later-stage access abuse.

NHI Mgmt Group analysis

Infostealers are identity incidents, not just endpoint incidents. Maranhão Stealer targets the material that makes identity usable in practice: browser credentials, cookies, and local secrets. Once that data is stolen, normal login controls may never see the attack path. That means IAM and endpoint teams should treat infostealer telemetry as identity-risk telemetry, not only malware telemetry.

The named failure mode here is credential reuse after endpoint compromise. The malware succeeds because users still execute untrusted installers and because stolen access material remains valid long enough to matter. That is a governance gap in session and secret lifecycle management, not just a detection gap. Practitioners should assume that endpoint compromise can bypass strong authentication if session material is not bounded and monitored.

Double .tmp masquerading is a useful concept for detection engineering. The article shows how attackers hide behind odd file naming, reflective loading, and registry persistence to blend into routine Windows activity. This is exactly where cross-domain correlation matters, because a suspicious file path may be meaningless alone but highly actionable when paired with persistence and host discovery. Teams should tune detections around behavioural clusters, not isolated indicators.

Infostealers expose the weak link between human identity and machine identity. The same endpoint that holds a user's browser session can also hold API keys, saved credentials, and operational secrets. That overlap means compromise can move from a user account into systems and cloud services without a fresh authentication event. Identity programmes should treat endpoint-stealed secrets as part of the non-human identity attack surface.

Hidden-persistence workflows are a lifecycle problem. The malware's use of Run keys, hidden files, and local artefacts shows that cleanup is only effective when removal is verified, not assumed. Without explicit lifecycle controls for malicious artefacts, defenders can declare victory while the infection still has a foothold. Practitioners need containment, eradication, and post-cleanup validation as a single control chain.

What this signals

Secret exposure and session theft are increasingly converging. Infostealers do not need to break cryptography when they can steal the credentials and cookies that already grant access. That should push security teams to align endpoint detection with secret rotation, session revocation, and access review workflows, especially where browser-stored access material still exists.

Identity programmes need a sharper boundary between user compromise and machine compromise. The same infected host may expose human sessions, API keys, and service credentials in one incident. For teams responsible for IAM and NHI governance, that means compromise response has to include revocation across both human and non-human access paths, not just endpoint cleanup.

Hidden persistence and masquerading are signs of detection debt. When attackers can hide with naming tricks and registry artefacts, the gap is often in behavioural correlation, not in the lack of logs. Security teams should use Windows telemetry, host discovery, and secret hygiene controls together so one weak signal does not become a full identity breach.

For practitioners

• Correlate endpoint and identity telemetry Link suspicious Windows process activity to browser credential use, session token reuse, and cloud sign-ins so infostealer infections surface as identity events, not isolated malware alerts.
• Alert on reflective loading and masqueraded file paths Detect double .tmp execution patterns, unusual DLL loads such as reflective loaders, and hidden-file tactics like attrib.exe +h +s in the same process tree.
• Hunt for registry persistence in user space Search for Run key entries that point to user-writable locations such as AppData or fake updater directories, then verify that the binary and supporting artefacts are removed.
• Use SCA to verify eradication After containment, confirm that malicious directories, updater.exe, and hidden crypto.key artefacts are absent before returning the endpoint to service.
• Treat stolen secrets as immediately exposed Rotate any browser-saved credentials, API keys, or wallet-adjacent secrets that were present on an infected host, because infostealers can exfiltrate them before detection.

Key takeaways

• Maranhão Stealer shows how commodity infostealers turn Windows endpoints into identity compromise points by stealing credentials, cookies, and other reusable secrets.
• The malware's double .tmp paths, reflective loading, Run key persistence, and hidden-file tactics show why behaviour-based detection is more reliable than file-only control.
• For practitioners, the control priority is correlation plus eradication validation, because stolen session and secret material can outlive the endpoint infection itself.

Key terms

• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• Reflective DLL Loading: Reflective DLL loading is a technique that lets malware load a DLL into memory without using the normal Windows loader path. It reduces visibility for some controls and helps attackers run code while avoiding simple file-based detection and some traditional injection checks.
• Run key persistence: A Windows persistence technique that places a command in a registry Run value so it executes automatically when a user logs in. It is common because it is simple, reliable, and hard to notice if teams do not correlate registry changes with process execution and file location.
• Secrets Sprawl: The uncontrolled proliferation of sensitive credentials — API keys, tokens, passwords, certificates — across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.

What's in the full article

Wazuh's full article covers the operational detection detail this post intentionally leaves for the source:

• Sysmon event mappings and rule logic for each Maranhão Stealer behaviour, including double .tmp execution and isdecmp.dll loading
• Wazuh SCA policy examples that check for installer directories, updater.exe, and hidden crypto.key artefacts on Windows endpoints
• Step-by-step agent and dashboard configuration for capturing Windows events and validating malware artefacts
• The exact rule IDs and remediation logic used to confirm whether the endpoint is still infected

👉 Wazuh's full article covers the Sysmon rules, SCA checks, and endpoint validation steps.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity lifecycle controls to the broader risk that stolen credentials create across environments.