Reads user/profile data of local email clients

Email clients store some user data on disk where infostealers will often target it.

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Network Share Discovery

Attempt to gather information on host network.

Obfuscated Files or Information: Command Obfuscation

Adversaries may obfuscate content during command execution to impede detection.

Deletes itself

Discovers running processes

Running process information can be used to identify security tools or plan follow-on actions.