Page 121 - Cyber Defense eMagazine Annual RSA Edition for 2024
P. 121
This malware's main aim is to steal saved passwords and session cookies from web browsers like
Chrome, Opera, Microsoft Edge, and Brave. For each browser, the malware locates where sensitive user
data is stored, such as cookies and login credentials for different websites.
This JavaScript code seems to be designed to gather encrypted data, possibly related to browsers. It
goes through an array called "browserPath" that holds possible paths to browser data.
Read a file named "Local State".
Extract an encrypted key from the JSON content it reads.
Use PowerShell to decrypt the key.
Add the decrypted key to the respective element in the "browserPath" array.
121
