Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 1060504" data-attributes="member: 86910">With this file not being obfuscated it is quite straightforward to determine what it does and that is copying bookmarks and history of Chrome, Firefox, Edge and Opera to BookMarks.txt and uploading this to Discord as indicated by the PowerShell function name.What is missing, is the context where and how this Powershell code is being used.This part of the code references a variable $dcThis variable is not set, but it should contain the upload location for Discord. This is also the reason why it is not working. There is no evasion going on, it is just incomplete.Without context it can be hard to determine if such a file is malicious or clean. However, in this case, I would give it a malware verdict, because I cannot imagine any legitimate reason to upload such data to Discord.There might be a small chance that some legitimate application has an edge case for doing this, but as a malware analyst I would decide to detect this as malware until someone complains, because in all cases I have seen so far such a functionality was in context of a stealer or RAT with stealing functionality, using Discord channels to communicate and exfiltrate data.It is odd though, that the code is not obfuscated. I can imagine this being the result of an AMSI dump, it being the code after unpacking, or being some template or example code for a malware.</blockquote>

[QUOTE="struppigel, post: 1060504, member: 86910"] With this file not being obfuscated it is quite straightforward to determine what it does and that is copying bookmarks and history of Chrome, Firefox, Edge and Opera to BookMarks.txt and uploading this to Discord as indicated by the PowerShell function name. What is missing, is the context where and how this Powershell code is being used. This part of the code references a variable $dc This variable is not set, but it should contain the upload location for Discord. This is also the reason why it is not working. There is no evasion going on, it is just incomplete. Without context it can be hard to determine if such a file is malicious or clean. However, in this case, I would give it a [COLOR=rgb(184, 49, 47)][B]malware[/B][/COLOR] verdict, because I cannot imagine any legitimate reason to upload such data to Discord. There might be a small chance that some legitimate application has an edge case for doing this, but as a malware analyst I would decide to detect this as malware until someone complains, because in all cases I have seen so far such a functionality was in context of a stealer or RAT with stealing functionality, using Discord channels to communicate and exfiltrate data. It is odd though, that the code is not obfuscated. I can imagine this being the result of an AMSI dump, it being the code after unpacking, or being some template or example code for a malware. [/QUOTE]

Verification