: Frequently used to deliver the final payload by downloading it from encrypted cloud storage links (like Google Drive or OneDrive). Indicators of Compromise (IoCs)
Credential theft, system reconnaissance, and data exfiltration.
Fake "Outstanding Statement of Account" (matching the "STA" prefix).
: An advanced infostealer that captures keystrokes, screenshots, and credentials from web browsers and email clients (Outlook, Thunderbird).
: Once the user extracts the .rar file, it typically contains a heavily obfuscated executable ( .exe ), a Screensaver file ( .scr ), or a JavaScript file ( .js ).
: A commercial remote control tool used by threat actors to gain full control over the webcam, microphone, and file system.
: The extracted file acts as a loader. It may use Process Hollowing to inject malicious code into legitimate Windows processes (like cvtres.exe or vbc.exe ) to evade detection.
Windows-based systems, often delivered via spoofed invoices or shipping notifications. Infection Vector
: Frequently used to deliver the final payload by downloading it from encrypted cloud storage links (like Google Drive or OneDrive). Indicators of Compromise (IoCs)
Credential theft, system reconnaissance, and data exfiltration.
Fake "Outstanding Statement of Account" (matching the "STA" prefix). sc24381-STAv12415353.rar
: An advanced infostealer that captures keystrokes, screenshots, and credentials from web browsers and email clients (Outlook, Thunderbird).
: Once the user extracts the .rar file, it typically contains a heavily obfuscated executable ( .exe ), a Screensaver file ( .scr ), or a JavaScript file ( .js ). : Frequently used to deliver the final payload
: A commercial remote control tool used by threat actors to gain full control over the webcam, microphone, and file system.
: The extracted file acts as a loader. It may use Process Hollowing to inject malicious code into legitimate Windows processes (like cvtres.exe or vbc.exe ) to evade detection. : The extracted file acts as a loader
Windows-based systems, often delivered via spoofed invoices or shipping notifications. Infection Vector
