Skip to content
Threat Feed
Subscribe

Actor

Braodo Stealer

4 briefs RSS
high threat

Malicious Termination of Browser Processes via Taskkill

The use of taskkill to forcibly terminate browser processes such as Chrome, Firefox, and Edge, often associated with credential-stealing malware like Braodo stealer, is detected, allowing it to unlock and steal sensitive browser data.

Chrome +5 Braodo Stealer credential-theft taskkill braodo-stealer windows
2r 1t
high threat

Detection of Taskkill Command to Terminate Browser Processes

This analytic detects the use of the taskkill command to terminate known browser processes, a technique employed by malware such as Braodo stealer to steal credentials by forcefully closing browsers like Chrome, Edge, and Firefox to unlock files containing sensitive information.

Splunk Enterprise +2 Braodo Stealer credential-theft malware windows
2r
high threat

Braodo Stealer Screen Capture in TEMP Directory

This analytic detects the creation of screen capture files in the TEMP directory, specifically targeting activity associated with the Braodo stealer malware, which captures screenshots of the victim's desktop as part of its data theft activities.

Splunk Enterprise +2 Braodo Stealer stealc-stealer crypto-stealer braodo-stealer apt37 hellcat-ransomware vip-keylogger screen-capture malware
2r 1t
high threat

Chrome Credential Theft via Password Store Copying

The Braodo stealer and other malware copy Chrome's Local State and Login Data files to temporary directories to steal encrypted user credentials.

Chrome Braodo Stealer credential-access malware windows
2r 1t