agentsclimarketplace
Sign in

Analyzing infostealer credential theft

Skill meltedinhex/analyst-ai-pack/skills/analyzing-infostealer-credential-theft

Analyzes infostealer samples by mapping the browser, credential store, wallet, and application paths they target, and the exfiltration channel used, from static strings and behavior. Activates for requests to analyze an infostealer, identify targeted credential stores, or map stealer collection and exfiltration behavior.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-infostealer-credential-theft

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
  • runs commandsInstructs the agent to run 1 command, including `python scripts/analyst.py profile sample.bin`.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 422 tokens by cl100k_base, as published. Nobody here has run it

Analyzing Infostealer Credential Theft

When to Use

  • You have an infostealer sample and need to enumerate what it targets: browser credential/cookie stores, crypto wallets, FTP/VPN/messaging app configs, and the exfil channel.
  • You are building detections from the file paths and endpoints a stealer references.

Do not use this to recover credentials yourself — it characterizes what the malware targets from inert static analysis.

Prerequisites

  • The sample (read inertly), optionally with extracted strings.

Safety & Handling

  • Read bytes statically; defang exfil endpoints; never run the stealer.

Workflow

Step 1: Map targeted artifacts

python scripts/analyst.py profile sample.bin

Matches references to known browser paths (Login Data, Cookies, Web Data), wallet directories, app config paths, and credential APIs, grouped by category.

Step 2: Identify exfiltration channel

Detects HTTP(S) POST endpoints, Telegram bot tokens, Discord webhooks, and FTP/SMTP usage in strings.

Step 3: Build the target/exfil profile

Summarize targeted stores and the exfil channel, mapping to ATT&CK.

Step 4: Defang and report

Defang endpoints and produce IOCs for detection.

Validation

  • Targeted artifacts are grouped (browsers, wallets, apps, system credential stores).
  • The exfil channel is identified with a defanged endpoint where present.
  • Findings map to ATT&CK credential-access/collection/exfiltration techniques.

Pitfalls

  • Generic browser paths can appear in benign tools — corroborate with theft behavior.
  • Missing wallet/app targets that use obfuscated path strings.
  • Reporting live exfil endpoints (webhooks, bot tokens) without defanging.

References

What ships with it: 3 files

4.5 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.