BRUSHWORM And BRUSHLOGGER Misspelled Photoes Directory Creation

Kaung Khant Ko@kaungkhantko

•updated Apr 3, 2026•1•0•57

Detects the creation of files within a specifically misspelled 'Photoes' directory located in ProgramData. This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger to store XOR-encrypted keystroke logs (.trn files).