en
Ades44Caliber variantStormKitty variantRL Stealer (also known as Ades, 44Caliber variant and StormKitty variant) is an information-stealing malware family. RL Stealer targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens, FTP and VPN client credentials, Clipboard contents and Desktop screenshot. As of 11/10/2026, CyStack's research records 2 variants distributed through 1 channel, with medium attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
RL Stealer is a .NET infostealer derived from the open-source
razexgod/44CALIBER Discord-exfiltration builder. The panel
writes an Information.txt whose body matches 44CALIBER's
upstream SystemInfo.cs writer character-for-character for
the first five sections, then appends a sixth section carrying
HDD: / MAC: / BIOS caption: hardware identifiers that
the upstream does not emit. Each key/value line opens with a
single leading space (invariant from the upstream string
concatenation), and sections are separated by equals-sign
rules.
Family attribution: confidence is medium. A community
stealer-format catalogue documents the format under the RL
Stealer label, the upstream razexgod/44CALIBER GitHub source
code matches the body shape, and public write-ups describe RL
Stealer as a rebranded Ades stealer. Two independent public
sources do not jointly publish the format-to-family mapping,
so the attribution rests on community catalog plus open-source
builder-code confirmation.
1 distinct distribution channel recorded for this malware
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Panel name | Distribution channel | Confidence |
|---|
| rl******** | Telegram | Medium |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
2 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
1c8a415... | 36 | Medium |
48d2f4a... | 161 | Medium |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Operating system: <value> PC user: <value> ClipBoard: <value> Launch: <value> Screen resolution: <value> Current time: <value> HWID: <value> CPU: <value> RAM: <value> GPU: <value> IP Geolocation: <value> Log Date: <value> BSSID: <value> HDD: <value> MAC: <value> BIOS caption: <value>
