Slavasoft FSUM and Hashcalc md5 & File Integrity for Windows
ID: b04efdde-b14f-5ab4-92c8-199ffe2d26ec
STIX ID: report--b04efdde-b14f-5ab4-92c8-199ffe2d26ec
Feed Name: Darknet
DumpBrowserSecrets is a post-exploitation credential-harvesting tool for Windows that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries and history from Chromium-based and Firefox browsers. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, uses DPAPI/NSS handling for other browsers, includes multiple evasion features (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication), and outputs structured JSON for red-team or attacker use; the report also covers detection opportunities and mitigation recommendations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
