TRANSLATEXT
- ID
- S1201
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 6 Feb 2025
TRANSLATEXT is malware that is believed to be used by Kimsuky.[1] TRANSLATEXT masqueraded as a Google Translate extension for Google Chrome, but is actually a collection of four malicious Javascript files that perform defense evasion, information collection and exfiltration.[1]
Techniques used (15)
- T1012 Query Registry
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1059.001 PowerShell
- T1071.001 Web Protocols
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1112 Modify Registry
- T1113 Screen Capture
- T1114 Email Collection
- T1176.001 Browser Extensions
- T1185 Browser Session Hijacking
- T1205 Traffic Signaling
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers