Executive Summary
A recently identified campaign hosted on the domain gaiadeqi[.]com distributes information-stealer malware by impersonating legitimate software installers, specifically VLC Media Player. The attack begins with an heavily obfuscated JavaScript file that employs multiple decoding stages and custom byte transformations to evade static analysis. Once active, the dropper downloads a ZIP archive containing the final payload, which is then staged in local temporary directories.
Technical analysis reveals the malware is designed to harvest sensitive data from various applications, including Outlook SMTP credentials, ProtonVPN configurations, FileZilla FTP server data, and Thunderbird profiles. Furthermore, the threat actor utilizes a specific evasion technique by launching Google Chrome with the '--no-sandbox' flag to bypass security controls and extract browser-stored passwords and cookies. The malware also establishes persistence via the Windows 'RunOnce' registry key and communicates with a command-and-control (C2) server at 62[.]193[.]193[.]90.
This threat poses a significant risk to organizational credential integrity and data privacy. Affected sectors should prioritize rotating credentials for compromised users and implementing network blocks on the identified malicious infrastructure. The use of .NET Reactor for packing and embedded Lua scripting suggests a level of sophistication aimed at maintaining long-term data collection capabilities.