The full location of the file the malware ran from on the infected device; in logs it shows where the infection came from.
Most infostealers write the path of their own executable to the system information file. This path tells what the user ran: a “crack” file in the Downloads folder, an archive extracted in a temporary folder or a fake installer. MITRE ATT&CK
Malware imitates system folders and familiar file names in this path to look legitimate. MITRE ATT&CK
The malware writes the path it ran from to the system information file. MITRE ATT&CK
In logs from the same campaign, the path and file name repeat.
The path points to the distribution channel: game cheat, activator, fake update.
Zscaler documented that the second version of Raccoon downloads legitimate libraries such as nss3.dll and sqlite3.dll and gathers the stolen data in the user’s AppData\Local folder before sending it. Zscaler
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy