: An advanced infostealer that captures keystrokes, screenshots, and credentials from web browsers and email clients (Outlook, Thunderbird).
Windows-based systems, often delivered via spoofed invoices or shipping notifications. Infection Vector
: The malware often creates a scheduled task or modifies the Windows Registry ( HKCU\Software\Microsoft\Windows\CurrentVersion\Run ) to ensure it restarts after a system reboot. Malware Payload Analysis
Urgent requests for "Payment Advice" or "Shipping Documents."
Fake "Outstanding Statement of Account" (matching the "STA" prefix).
: Look for suspicious files in %AppData% or %Temp% folders with random alphanumeric names. Recommendation If you have encountered this file: Do not extract or run the contents.