PupkinStealer: The New .NET Info-Stealer Leveraging Telegram to Loot Your Data

First observed in April 2025, PupkinStealer is a lightweight but effective info-stealer written in C#. It harvests browser credentials, Telegram & Discord session data, desktop files and full-screen screenshots, zips everything, then exfiltrates the loot via the Telegram Bot API to an attacker-controlled channel.

Why PupkinStealer Matters

• Telegram C2 channel: Legitimate cloud messaging platform doubles as stealthy exfil.
• No frills, quick profit: Lacks heavy obfuscation or persistence—lower entry bar for low-skill operators.
• Compact footprint: ~6.2 MB binary, “AnyCPU” compiled to run on both x86 & x64 Windows.
• Rapid tasking: Five parallel async tasks for fast grab-and-go.

Technical Breakdown

Stage	Function	Details
1	DecryptingBrowsersPasswords()	Extracts Chromium master keys & decrypts saved passwords (AES-GCM).
2	GrabberDesktop()	Copies .pdf, .txt, .sql, .jpg, .png from user Desktop.
3	GrabberTelegramSession()	Locates tdata, kills Telegram, steals session.
4	GrabberDiscordToken()	Regex-hunts Discord tokens in leveldb.
5	GrabberScreenshot()	Captures 1920×1080 desktop screenshot (Screen.jpg).
6	DataDispatch()	Zips loot → sendDocument call to Telegram Bot API.

Command-and-Control Workflow

1. Victim runs PupkinStealer.exe.
2. Stealer spawns 5 async tasks to gather data.
3. Creates archive [User]@ardent.zip.
4. Sends ZIP to Telegram bot botkanalchik_bot.
5. Attacker receives file instantly in private Telegram chat.

Indicators of Compromise (IOCs)

File Name : PupkinStealer.exe
MD5       : fc99a7ef8d7a2028ce73bf42d3a95bce
SHA-256   : 9309003c245f94ba4ee52098dadbaa0d0a4d83b423d76c1bfc082a1c29e0b95f
C2 URL    : https[:]//api.telegram.org/bot<token>/sendDocument?chat_id=7613862165
Temp Dir  : %APPDATA%\Temp\\Grabbers\
  

Detection & Mitigation Checklist

• Block Telegram Bot API egress where not required.
• Hunt for ZIP uploads to api.telegram.org in proxy logs.
• Monitor file creation under %APPDATA%\Temp\\Grabbers.
• Harden browsers (disable credential storage / master password).
• Ensure EDR rules flag mass credential access or screenshot actions.
• Raise user awareness around cracked software / phishing attachments.
• Apply least-privilege; use AppLocker or WDAC to block unsigned .NET bins.

Business Impact

• Credential resale: Harvested logins fetch quick cash in dark-web markets.
• Account takeover: Stolen Telegram/Discord sessions enable social-engineering.
• Ransom hands-off: Data can seed follow-on ransomware or extortion campaigns.

Conclusion

PupkinStealer shows how low-complexity malware can still yield high returns. By abusing Telegram for C2, it skirts many perimeter controls. Add its hashes, network indicators and behaviors to your detection stack, and treat Telegram egress with the same scrutiny you give any unvetted cloud service.

Sources & Further Reading

• CYFIRMA – “PupkinStealer: A .NET-Based Info-Stealer,” 9 May 2025.
• GBHackers – “PupkinStealer – .NET Malware Steals Browser Data and Exfiltrates via Telegram,” 12 May 2025.
• Navneet Blog – “Pupkin: A Simple .NET Info-Stealer Exfiltrating Data via Telegram,” Apr–May 2025.