AgentStack
Sign in Publish
MCP servers Skills Toolkits Why AgentStack Sell Docs
Sign in
SKILL verified Apache-2.0 Self-run

Analyzing Infostealer Credential Theft

skill-meltedinhex-analyst-ai-pack-analyzing-infostealer-credential-theft · by meltedinhex

Analyzes infostealer samples by mapping the browser, credential store, wallet, and

↗ Website ↗ Repository
— No reviews yet
0 installs
14 views
0.0% view→install

Install

$ agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-infostealer-credential-theft

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Analyzing Infostealer Credential Theft? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Analyzing Infostealer Credential Theft

When to Use

  • You have an infostealer sample and need to enumerate what it targets: browser credential/cookie

stores, crypto wallets, FTP/VPN/messaging app configs, and the exfil channel.

  • You are building detections from the file paths and endpoints a stealer references.

Do not use this to recover credentials yourself — it characterizes what the malware targets from inert static analysis.

Prerequisites

  • The sample (read inertly), optionally with extracted strings.

Safety & Handling

  • Read bytes statically; defang exfil endpoints; never run the stealer.

Workflow

Step 1: Map targeted artifacts

python scripts/analyst.py profile sample.bin

Matches references to known browser paths (Login Data, Cookies, Web Data), wallet directories, app config paths, and credential APIs, grouped by category.

Step 2: Identify exfiltration channel

Detects HTTP(S) POST endpoints, Telegram bot tokens, Discord webhooks, and FTP/SMTP usage in strings.

Step 3: Build the target/exfil profile

Summarize targeted stores and the exfil channel, mapping to ATT&CK.

Step 4: Defang and report

Defang endpoints and produce IOCs for detection.

Validation

  • Targeted artifacts are grouped (browsers, wallets, apps, system credential stores).
  • The exfil channel is identified with a defanged endpoint where present.
  • Findings map to ATT&CK credential-access/collection/exfiltration techniques.

Pitfalls

  • Generic browser paths can appear in benign tools — corroborate with theft behavior.
  • Missing wallet/app targets that use obfuscated path strings.
  • Reporting live exfil endpoints (webhooks, bot tokens) without defanging.

References

  • See [references/api-reference.md](references/api-reference.md) for the profiler.
  • ATT&CK T1555.003 and T1539 (linked in frontmatter).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Web & Browser