KiwiStealer
- Malware type
- trojan
- Family
- Malware family
- Profile updated
- 2026-07-07 14:43:58
Targeted industries: professional-services technology-and-telecommunications media-and-entertainment
Context
According to Threatray, KiwiStealer is a simple file stealer first discovered in late 2024. It starts by gathering the computer name and username. It also retrieves the current system time, which will be used later to check the last modification time of files on the machine. KiwiStealer searches through a predefined list of directories to gather files and only exfiltrates files that are smaller than 50MB and have been modified within the past year. It targets these extensions: z7, .txt, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .jpg, .zip, .rar, .apk, .neat, .err, .eln, .ppi, .er9, .azr, .pfx, .ovpn.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Kiwistealer_Auto (yara-rule)
Reports & references
- threatray.com — The Bitter End Unraveling Eight Years Of Espionage Antics Part Two (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Kiwistealer (report)