SapphireStealer Analysis & Removal Guide

SapphireStealer is a versatile information-stealing malware, emerged in December 2022. Analysts discovered multiple variants since then, which is possible because of its open source code, available on GitHub.

This malware targets corporate credentials, gathering a range of device data, capturing screenshots, and exfiltrating files. Its adaptable nature and potential use by various threat actors make it a concerning cyber threat, capable of facilitating cyber-espionage, ransomware attacks, and other malicious activities through compromised entities.

SapphireStealer Overview

SapphireStealer is an open-source information stealing malware, that was published on GitHub back in December 2022. Further, various versions with distinct capabilities have emerged, suggesting its adoption by multiple threat actors.

SapphireStealer analysis on VirusTotal

Having the code available for anyone opens the gates for infinite modifications to the code. This makes SapphireStealer potentially the most flexible malware, that can be adjusted for every specific attack. Of particular concern is its involvement in attacks aimed at corporate credentials. Such data is often sought by cybercriminals for resale, facilitating cyber-espionage, ransomware, and further assaults against the compromised corporate entities. SapphireStealer underscores the ever-evolving landscape of digital threats and the importance of robust cybersecurity measures.

SapphireStealer Infection Stages

The initial stages of SapphireStealer’s infection process can vary among its different versions, with some employing multi-stage approaches. Likewise, these variants differ in their methods of data exfiltration, functionalities, and the scope of targeted information. SapphireStealer initiates by collecting device-specific data, such as device name, CPU architecture, GPU, screen resolution, operating system version, and IP address.

The primary focus of this malware is to target credentials stored within web browsers (full list of browsers targeted). Across its versions, the specific information of interest may vary, but generally includes visited URLs, viewed webpages, search queries, Internet cookies, login credentials (usernames/passwords), and even credit card numbers.

List of browsers targeted by SapphireStealer

SapphireStealer also possesses the capability to capture screenshots and terminate running processes. Moreover, it can exfiltrate victims’ files, with some variants targeting a limited set of file types, while others encompass a wide range. For instance, one version collected text files (.txt), Microsoft Office documents (.doc, .docx), PDFs (.pdf), and various image formats (.img, .jpg, .png).

As mentioned earlier, multiple versions of SapphireStealer exist, with the potential for further iterations featuring diverse functionalities. We expect this malware to use a different way of storing collected data, as well as aim at more specific file formats (CAD projects, blueprints, PDF reports, etc.).

How does this malware spread?

Cybercriminals typically employ phishing and social engineering tactics to distribute malware, with commonly used methods including:

• Drive-By Downloads. Deceptive and stealthy downloads that occur without user consent commonly contain unwanted content. More often, you will see unwanted programs installed in such a way. Though, malware does not disdain such a spreading way either.
• Online Scams. Tricking users into downloading malware through fraudulent schemes is an old-timer of malware spreading. Nowadays, it just obtained a new form – hackers reach their victims on phone, pretending to be tech support specialists. They push malware to the victim’s device under the guise of “fix tool” for the problem they made up.
• Malvertising. Malicious advertisements that lead to malware downloads. Existed since online ads exist.
• Untrustworthy Download Sources. Obtaining software from sources like freeware websites, third-party platforms, or Peer-to-Peer networks is risky, as there is no way to make sure that the software package is clear.
• Illegal Program Activation Tools. Using cracks or keygens is illegal itself. However, hackers boost that risk even more by using such applications as shells for malware injection.
• Fake Updates. Downloading updates from unverified sources that can introduce malware. It is especially risky since malware under this disguise can easily request admin privileges.
• Some malicious programs can also spread through local networks and removable storage devices like USB drives.

How to remove SapphireStealer?

Frequently Asked Questions (FAQ)