Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Misericorde Stealer

Also known as:MisericordeMisericorde C++ stub USER-HOST PANEL

What is the Misericorde Stealer infostealer, and what data does it steal?

Misericorde Stealer (also known as Misericorde and Misericorde C++ stub USER-HOST PANEL) is an information-stealing malware family. Misericorde Stealer targets browser credentials, Full identity preamble: username, hostname, HWID, Public IPv4 plus city and IANA timezone from IP geolocation, OS caption with edition and build number, Display resolution and system language, CPU, GPU, and RAM hardware inventory and Malware install path (observed shape: `C:\ProgramData\<DropperName>\<Payload>.exe`). As of 11/10/2026, CyStack's research records 1 variant distributed through 2 channels, with low attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

Misericorde Stealer is a C++ Windows info-stealer advertised on HackForums under the product listing Misericorde Stealer (C++ stub) - USER-HOST PANEL with v10 and v20 versions. The malware self-declares its name through an ASCII-art banner block spelling Misericorde and a Telegram -https://t.me/misericorde_supp operator support-channel URL emitted at the top of every UserInformation.txt panel.

The panel ships a compact 10-field identity preamble (Username, Hostname, FileLocation, IP, Country, Timezone, City, Hwid, Logdate, Buildtag), then a [System] bracket-section block (OS Product, Screensize, Keyboard, System Language), then a [Hardware] bracket-section block (GPU, CPU, RAM). The single-word Username / Hostname / Hwid / Logdate / Buildtag key spellings distinguish Misericorde from Redline-lineage panels (which use two-word forms like User Name / Computer Name / HWID).

The observed sample distributes through the @UP_DAISYCLOUD Telegram reseller channel with the Daisy Cloud per-line watermark overlay (obfuscated Daisy Private cloud scramble on every payload line). The underlying Misericorde body is independent of Daisy Cloud; other resellers may ship the same panel without the watermark.

Family attribution rests on the self-declared banner literal plus the HackForums product listing (community catalog / underground forum). No public research publishes a Misericorde writeup, and the community catalogues do not document it either. attribution_confidence = 'low' reflects the one-underground-forum-source provenance combined with the strong banner self-declaration signal.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

2 distinct distribution channels recorded for this malware

Panel name	Distribution channel	Confidence
—	Telegram	Low
da********	Telegram	Low

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`ab788c5...`	1	Low

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence