TRANSLATEXT — Malware Profile
TRANSLATEXT is malware that is believed to be used by Kimsuky. TRANSLATEXT masqueraded as a Google Translate extension for Google Chrome, but is actually a collection of four malicious Javascript files that perform defense evasion, information collection and exfiltration.
MITRE ATT&CK techniques (15)
- T1012 Query Registry
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1059.001 PowerShell
- T1071.001 Web Protocols
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1112 Modify Registry
- T1113 Screen Capture
- T1114 Email Collection
- T1176.001 Browser Extensions
- T1185 Browser Session Hijacking
- T1205 Traffic Signaling
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers