Researchers observed a rise in sales (and offers for rent) of the new stealer on different underground forums and illicit marketplaces.
Cisco Talos threat researcher Edmund Brumaghin is certain with his observation that SapphireStealer possesses numerous entities that are modifying its code base, in order to accommodate additional data exfiltration processes, leading to the formation of many variations.
According to Brumaghin, the freshly compiled versions of the malware began "being uploaded to public malware repositories beginning in mid-January 2023, with consistent upload activity being observed through the first half of 2023."
Researchers say that several malware versions are already in use by multiple threat actors, amplifying their efficiency and effectiveness in their operations over time.
Capabilities of SapphireStealer
Apparently, the malware is designed to steal sensitive information from targeted systems. This information may include host information, screenshots, cached browser credentials and files stored on the system that match a predefined list of file extensions. Also, it is capable of determining the presence of credential databases for browser applications including Chrome, Yandex, Edge and Opera.
On execution, the malware creates a working directory and launches a file grabber that searches the victim's Desktop folder for files with the following file extensions: .txt, .pdf, .doc,.docx, .xml, .img, .jpg, and.png.
Subsequently, the malware compiles all of the logs into a compressed package called log.zip, which it then sends to the attacker over Simple Mail Transfer Protocol "using credentials defined in the portion of code responsible for crafting and sending the message."
After the logs are successfully exfiltrated, the malware deletes the working directory it had previously created and stops running.
Moreover, the malware operators are said to have released a malware downloader – FUD-Loader – which uses HTTP/HTTPS communications to retrieve more executables from infrastructure under the control of the attacker. It then saves the retrieved content to disk and executes it to continue the infection process.
"In most of the cases where this loader was used, it retrieved the SapphireStealer binary payloads being hosted on the infrastructure described in the next section, allowing us to attribute those samples to the same threat actor," the researchers said.
"One of the byproducts of readily available and open-source malware codebases is that the barrier to entry into financially motivated cybercrime has continued to decrease over time," the researchers added.
The researchers further explained how stealers make it possible for attackers with less operational skill to launch an attack, which may be quite harmful to corporate environments because the data obtained is frequently used for more attacks that are followed.