analyzing-infostealer-credential-theft

Name: analyzing-infostealer-credential-theft
Author: meltedinhex

18stars5forks

How to install analyzing-infostealer-credential-theft?

meltedinhex/analyst-ai-pack/analyzing-infostealer-credential-theft

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-infostealer-credential-theft

Installs into the current project.

Summary

Analyzes infostealer samples by mapping the browser, credential store, wallet, and

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Infostealer Credential Theft
2
3	## When to Use
4
5	- You have an infostealer sample and need to enumerate what it targets: browser credential/cookie
6	stores, crypto wallets, FTP/VPN/messaging app configs, and the exfil channel.
7	- You are building detections from the file paths and endpoints a stealer references.
8
9	Do not use this to recover credentials yourself — it characterizes what the malware targets
10	from inert static analysis.
11
12	## Prerequisites
13
14	- The sample (read inertly), optionally with extracted strings.
15
16	## Safety & Handling
17
18	- Read bytes statically; defang exfil endpoints; never run the stealer.
19
20	## Workflow
21
22	### Step 1: Map targeted artifacts
23
24	```bash
25	python scripts/analyst.py profile sample.bin
26	```
27
28	Matches references to known browser paths (`Login Data`, `Cookies`, `Web Data`), wallet
29	directories, app config paths, and credential APIs, grouped by category.
30
31	### Step 2: Identify exfiltration channel
32
33	Detects HTTP(S) POST endpoints, Telegram bot tokens, Discord webhooks, and FTP/SMTP usage in
34	strings.
35
36	### Step 3: Build the target/exfil profile
37
38	Summarize targeted stores and the exfil channel, mapping to ATT&CK.
39
40	### Step 4: Defang and report
41
42	Defang endpoints and produce IOCs for detection.
43
44	## Validation
45
46	- Targeted artifacts are grouped (browsers, wallets, apps, system credential stores).
47	- The exfil channel is identified with a defanged endpoint where present.
48	- Findings map to ATT&CK credential-access/collection/exfiltration techniques.
49
50	## Pitfalls
51
52	- Generic browser paths can appear in benign tools — corroborate with theft behavior.
53	- Missing wallet/app targets that use obfuscated path strings.
54	- Reporting live exfil endpoints (webhooks, bot tokens) without defanging.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the profiler.
59	- ATT&CK T1555.003 and T1539 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-infostealer-credential-theft

18stars5forks

View on GitHub

How to install analyzing-infostealer-credential-theft?

meltedinhex/analyst-ai-pack/analyzing-infostealer-credential-theft

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-infostealer-credential-theft

Installs into the current project.

Summary

Analyzes infostealer samples by mapping the browser, credential store, wallet, and

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Infostealer Credential Theft
2
3	## When to Use
4
5	- You have an infostealer sample and need to enumerate what it targets: browser credential/cookie
6	stores, crypto wallets, FTP/VPN/messaging app configs, and the exfil channel.
7	- You are building detections from the file paths and endpoints a stealer references.
8
9	Do not use this to recover credentials yourself — it characterizes what the malware targets
10	from inert static analysis.
11
12	## Prerequisites
13
14	- The sample (read inertly), optionally with extracted strings.
15
16	## Safety & Handling
17
18	- Read bytes statically; defang exfil endpoints; never run the stealer.
19
20	## Workflow
21
22	### Step 1: Map targeted artifacts
23
24	```bash
25	python scripts/analyst.py profile sample.bin
26	```
27
28	Matches references to known browser paths (`Login Data`, `Cookies`, `Web Data`), wallet
29	directories, app config paths, and credential APIs, grouped by category.
30
31	### Step 2: Identify exfiltration channel
32
33	Detects HTTP(S) POST endpoints, Telegram bot tokens, Discord webhooks, and FTP/SMTP usage in
34	strings.
35
36	### Step 3: Build the target/exfil profile
37
38	Summarize targeted stores and the exfil channel, mapping to ATT&CK.
39
40	### Step 4: Defang and report
41
42	Defang endpoints and produce IOCs for detection.
43
44	## Validation
45
46	- Targeted artifacts are grouped (browsers, wallets, apps, system credential stores).
47	- The exfil channel is identified with a defanged endpoint where present.
48	- Findings map to ATT&CK credential-access/collection/exfiltration techniques.
49
50	## Pitfalls
51
52	- Generic browser paths can appear in benign tools — corroborate with theft behavior.
53	- Missing wallet/app targets that use obfuscated path strings.
54	- Reporting live exfil endpoints (webhooks, bot tokens) without defanging.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the profiler.
59	- ATT&CK T1555.003 and T1539 (linked in frontmatter).

People who liked this also viewed

6 picks

Type