General
-
Target
https://cdn.discordapp.com/attachments/1186715831414030426/1256963554695839775/Aristois-Free.zip?ex=6682ae08&is=66815c88&hm=77f5c9baba2f9ccc16ddff763ac3b30e7a9d971d63713c1db9091d52423942cd&
-
Sample
240630-y54dlsxfpk
Score
7/10
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1186715831414030426/1256963554695839775/Aristois-Free.zip?ex=6682ae08&is=66815c88&hm=77f5c9baba2f9ccc16ddff763ac3b30e7a9d971d63713c1db9091d52423942cd&
Score7/10-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-