Scrapes saved usernames and passwords from web browsers (Chrome, Firefox, Edge).

Do you have a for this specific file that you'd like me to look up in threat databases?

Searches for local cryptocurrency wallet files and browser extensions to drain funds.

Once the user extracts and runs the internal file, the malware begins harvesting sensitive data from the infected machine. Key Threats & Capabilities

Usually contains an executable ( .exe ) or a script ( .vbs , .js ) designed to bypass basic antivirus detections through obfuscation.

Distributed via phishing emails, malicious YouTube video descriptions (promising "free" tools), or "warez" (pirated software) websites.

Collects hardware specifications, IP addresses, location data, and screenshots of the victim's desktop.

Unusual outbound connections to known Command & Control (C2) servers, often hosted on Russian or Eastern European IP ranges.