Data exfiltration (passwords, browser cookies, crypto wallets, and system metadata). Technical Analysis
Collected data is compressed and sent to a Command and Control (C2) server, often using legitimate services like GitHub or Discord as intermediaries to hide traffic. Recommended Actions
If you previously executed this file, assume all saved browser passwords and session tokens are compromised. Change your passwords and enable 2FA (Two-Factor Authentication) on all critical accounts.
Desktop wallet files (e.g., MetaMask, Exodus). Messaging: Session data from Telegram or Discord tokens.
If you have a of the specific file you're looking at, I can provide a more detailed breakdown of its exact behavior.
It targets sensitive directories, specifically looking for:
Once extracted and run, the payload performs "anti-VM" and "anti-debug" checks to ensure it isn't being analyzed by security researchers.