Cybergun_Technical_Analysis_of_the_Armageddons_Infostealer.pdf

This report provides a technical analysis of the Armageddon Group's Infostealer: a C++ Windows PE compiled in 2022 that uses phishing-delivered RTF/LNK/DOCX to run scripts (PowerShell/PE/VBScript), achieves persistence via a RUN registry entry and mutex (Global\flashUpdated_r), enumerates and collects numerous file types, stores filenames locally (IconsCache.db, profiles_c.ini, trend.txt), and exfiltrates data over HTTPS to dynamically generated subdomains of celticso.ru; the report includes a YARA rule, a SHA-256 sample hash, a C2 domain IOC, and MITRE ATT&CK mappings.