BTW, in case you didn't know, I fucking HATE

#Infostealers
#Winstealers

Sure, the lures are basic, as is the functionality, but they smash and grab every credential they can, exfil it immediately, then self-destruct. Unless you catch it on execution, or over the wire, congrats, all your creds probably got shipped to an access broker, and you never noticed, because these things almost never establish persistence.