value:  Fox Kitten has accessed files to gain valid credentials. ;; Hildegard has searched for SSH keys Docker credentials and Kubernetes service tokens. ;; jRAT can capture passwords from common chat applications such as MSN Messenger AOL Instant Messenger and and Google Talk. ;; LaZagne can obtain credentials from chats databases mail and WiFi. ;; Leafminer used several tools for retrieving login and password information including LaZagne. ;; MuddyWater has run a tool that steals passwords saved in victim email. ;; OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. ;; If an initial connectivity check fails pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access. ;; PoshC2 contains modules for searching for passwords in local and remote files. ;; Pupy can use Lazagne for harvesting credentials. ;; Pysa has extracted credentials from the password database before encrypting the files. ;; QuasarRAT can obtain passwords from FTP clients. ;; Smoke Loader searches for files named logins.json to parse for credentials. ;; Stolen Pencil has used tools that are capable of obtaining credentials from saved mail. ;; TA505 has used malware to gather credentials from FTP clients and Outlook. ;; TrickBot can obtain passwords stored in files from several applications such as Outlook Filezilla OpenSSH OpenVPN and WinSCP. Additionally it searches for the .vnc.lnk" affix to steal VNC credentials. ;; XTunnel is capable of accessing locally stored passwords on victims."
name: Unsecured Credentials: Credentials In Files