: Connections to unusual IP addresses or domains not associated with known services.
: To steal browser data (passwords, cookies, credit card info), cryptocurrency wallet files, and system information. Infection Chain
: Inside the archive is usually a file disguised with a fake icon (e.g., a PDF or folder icon). Once clicked, it executes a malicious script.
: Immediately take the infected machine offline to stop data exfiltration.
: The malware connects to a Command and Control (C2) server to upload stolen data and may establish persistence in the Windows Registry to run on startup. Indicators of Compromise (IoCs)
: Turn on Multi-Factor Authentication for all accounts to prevent unauthorized access even if credentials were stolen.
