Lightning Stealer

MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Execution T1204 User Execution

The Lightning stealer steals the Discord token from the following directory: “discord\Local Storage\leveldb”

Then malware steals the cookies data from moz_cookies table in “cookies.sqlite” file... Then malware steals cookies from cookies table present “Cookies” file

MITRE ATT&CK® Techniques... T1552 Unsecured Credentials

Lightning Stealer checks this directory along with the file names mentioned below: key4.db... logins.json... It first steals the data from the login.json file and looks for mozglue.dll and nss3.dll, which will be used to decrypt the “login.json” file.

MITRE ATT&CK® Techniques... T1007 System Service Discovery

The malware then proceeds to steal the victim’s system info. Figure 14 shows the system info gathered by malware. MITRE ATT&CK® Techniques... T1124 System Time Discovery

It initially identifies the Firefox-based browsers present in a system... those paths will be added to a new list for stealing data... After stealing data from Firefox-based browsers, the malware targets Chromium-based browsers.

After this, the malware takes a screenshot of the victim’s screen and saves it in the “AppData\Roaming\” folder named “1.png”.

After this, the malware exfiltrates the data to the following domain: hxxp[:]//panelss[.]xyz/Stealer/TSave The body of the request is sent in JSON format

Then it creates a file named “444.txt”... converts the stolen data into JSON strings... After this, the malware exfiltrates the data to the following domain: hxxp[:]//panelss[.]xyz/Stealer/TSave