Talos wars of customizations of the open-source info stealer SapphireStealer

Cisco reported that multiple threat actors are customizing the SapphireStealer information stealer after the leak of its source code.

Cisco Talos researchers reported that multiple threat actors have created their own version of the SapphireStealer after that the source code of the stealer was released on GitHub.

SapphireStealer is an open-source information stealer written in .NET, which is available in multiple public malware repositories since its public release in December 2022.

SapphireStealer allows operators to gather system data (i.e. IP address, hostname, screen resolution, OS version, CPU architecture, ProcessorId, and GPU information), and steal various browser credential databases and files that may contain sensitive user information.

The malware is also able to siphon files stored with specific extensions and take screenshots.

The malware looks for processes associated with Chrome, Yandex, Edge, and Opera browsers to kill them. The malware also checks for various browser database file directories for credential databases associated with 16 browsers, including Chrome, Microsoft Edge, Brave Browser, Opera, Comodo, and Yandex.

SapphireStealer dumps the contents of any credential databases, then stores it in a text file within the malware’s working directory called Passwords.txt.

“The malware creates a new subdirectory called `Files` within the malware’s working directory. A file grabber is then executed that attempts to locate any files stored within the victim’s Desktop folder that match a list of file extensions.” reads the report published by Talos. “The list varied across analyzed samples, but an example list is shown below:

• .txt
• .pdf
• .doc
• .docx
• .xml
• .img
• .jpg
• .png

Once the file grabber has completed execution, the malware then creates a compressed archive called log.zip containing all of the logs that were previously written to the malware’s working directory.”

The data are exfiltrated by transmitting it to the attacker via Simple Mail Transfer Protocol (SMTP). The researchers noticed that attackers are using hardcoded credentials.

Since the malware code was released, multiple threat actors modified it to enhance its capabilities.

Most of the SapphireStealer modifications observed by the researchers have been focused on improving data exfiltration and alerting for new infections. The experts added that many of these customizations have occurred independently and new functionality is not present in sample clusters associated with other threat actors.

“In one case, we observed a SapphireStealer sample where the data collected using the previously described process was exfiltrated using the Discord webhook API, a method we previously highlighted here.” continues the report.

Several customizations observed by Talos were able to alert the attackers to newly acquired infections by transmitting the log data via the Telegram posting API.

In several cases, Cisco Talos observed threat actors attempting to use a malware downloader, called FUD-Loader. The FUD-Loader malware downloader was also published by the same GitHub account. The downloader was initially committed to GitHub on January 2, 2023 and it’s been employed by multiple threats, including DcRat, njRAT, DarkComet, and AgentTesla.

The researchers published Indicators of Compromise (IOCs) for this threat on Talos’s Github repository.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)