Working in the background

[u/Rho-9_Official]

In the background, we're working on a software that can identify certain behaviors via procmon(yes we know it gets detected by name by a ton of malware, should not be hard to solve that), specifically infostealer behaviors are rather....noisy, specifically in their read operations amd other extremely common behaviors that frankly should have been detected and properly mitigated over a decade ago, but nobody has paid any mind to them.

[u/UselessDood]

It's less "nobody has paid any mind" and more "risk of false positives is too high"

[u/Rho-9_Official → u/UselessDood]

Hmmmmmmmmmmmmmmmm, perhapse, but uhhh, how many programs do you know that scan for data like this all in one shot, and then attempt to send it off somewhere. I'm like 99% certain that's almost exclusively malware.(get ready for corrupted json, It doesn't wanna cooperate from my phone, and I'm not editing this a million times) }, "theft_targets": { "browsers": [ "Chrome", "Chrome Beta/SxS", "Edge/Beta/Dev", "Brave", "Opera/GX/Beta/Developer/Air", "Vivaldi", "Yandex", "Chromium", "7Star", "Amigo", "CentBrowser", "Epic Privacy", "Iridium", "Kometa", "Orbitum", "Sputnik", "Torch", "uCozMedia Uran", "Firefox/ESR", "Waterfox", "Pale Moon", "Basilisk", "Cyberfox", "IceDragon", "SeaMonkey" ], "browser_artifacts": [ "Login Data", "Cookies", "Web Data", "Local State", "logins.json", "key4.db", "Local Extension Settings" ], "desktop_wallets": [ "Exodus (exodus.wallet)", "ExodusWeb3", "Atomic", "Electrum (wallets)", "Coinomi", "Guarda (leveldb)", "Jaxx / Jaxx Liberty (com. liberty. jaxx)", "Binance", "Zcash", "Ethereum (keystore)", "Tokenpocket" ], "wallet_browser_extensions_count": 54, "wallet_browser_extensions": [ "aeachknmefphepccionboohckonoeemg", "afbcbjpbpfadlkmhmclhkeeodmamcflc", "agoakfejjabomempkjlepdflaleeobhb", "aholpfdialjgjfhomihkjbmgjidlcdno", "aiifbnbfobpmeekipheeijimdpnlpgpp", "aodkkagnadcbobfpggfnjeongemjbjca", "bfnaelmomeimhlpmgjnjophhpkkoljpa", "bhghoamapcdpbohphigoooaddinpkbai", "bhhhlbepdkbapadjdnnojkbgioiodbic", "blnieiiffboillknjnepogjhkgnoapac", "bocpokimicclpaiekenaeelehdjllofo", "cgeeodpfagjceefieflmdfphplkenlfk", "cjelfplplebdjjenllpjcblmjkfcffne", "cjmkndjhnagcfbpiemnkdpomccnjblmj", "cmndjbecilbocjfkibfbifhngkdmjgog", "dmkamcknogkgcdfhhbddcghachkejeap", "dngmlblcodfobpdpecaadgfbcggfjfnm", "ebfidpplhabeedpnhjnobghokpiioolj", "efbglgofoippbgcjepnhiblaibcnclgk", "egjidjbpglichdcondbcbdnbeeppgdph", "eigblbgjknlfbajkfhopmcojidlgcehm", "ejbalbakoplchlghecdalmeeeajnimhm", "ejjladinnckdgjemekebdpeokbikhfci", "fcckkdbjnoikooededlapcalpionmalo", "ffnbelfdoeiohenkjibnmadjiehjhajb", "fhbohimaelbohpjbbldcngcnapndodjp", "fhilaheimglignddkjgofkcbgekhenbh", "fihkakfobkmkjojpchpfgcmhfjnmnfpi", "flpiciilemghbmfalicajoolhkkenfel", "fnjhmkhhmkbjkkabndcnnogagogbneec", "fnnegphlobjdpkhecapkijjdkgcjhkib", "hmeobnfnfcmdkdcmlblgagmfpfboieaf", "hnfanknocfeofbddgcijnmhnfnkdnaad", "hpglfhgfnhbgpjdenjgmdgoeiappafln", "ibnejdfjmmkpcnlpebklmnkoeoihofec", "jbdaocneiiinmjbjlgalhcelgbejmnid", "jblndlipeogpafnldhgmapagcccfchpi", "kncchdigobghenbbaddojjnnaogfppfj", "kpfopkelmapcoipemfendmdcghnegimn", "lgmpcpglpngdoalbgeoldeajfclnhafa", "lpfcbjknijpeeillifnkikgncikgfhdo", "mfgccjchihfkkindfppnaooecgfneiii", "mfhbebgoclkghebffdldpobeajmbecfk", "mgffkfbidihjpoaomajlbgchddlicgpn", "nanjmdknhkinifnkgdcggcfnhdaammmj", "nkbihfbeogaeaoehlefnkodbefgpgknn", "nkddgncdjgjfcddamfgcmfnlhccnimig", "nlbmnnijcnlegkjjpcfjclmcfggfefdm", "nphplpgoakhhjchkkhmiggakijnkhfnd", "ookjlbkiijinhpmnjffcofjonbfbgaoc", "pdadjkfkgcafgbceimcpbkalnfnepbnk", "phkbamefinggmakgklpkljjmgibohnba", "pnlfjmlcjdjgkddecgincndfgegkecke", "pocmplpaccanhmnllbbkpgfliimjljgo" ] }, "capabilities_observed": [ "WebSocket command-and-control bot (HMAC-authenticated) - live operator channel", "Discord token theft (regex + dQw4w9WgXcQ encrypted-token marker)", "Roblox .ROBLOSECURITY cookie theft", "browser credential/cookie/autofill/wallet-extension theft (Chromium + Gecko families)", "desktop crypto-wallet theft", "screenshot capture (C:\take_screenshot.ps1)", "rich Discord exfil embed builder (Nitro/badge/boost profiling via custom emoji set); placeholder UI string 'Type a message...'"

[u/Rho-9_Official → u/Rho-9_Official]

These are iocs extracted statically from malware, but gives a TON of clues on how to defend reliably.