# Hackers Adding More Capabilities to Open Source Malware
**微信 smartcat9999**
---
**September 3, 2023**
Researchers said that they observed an increase in the emergence of **new stealers being offered for sale or rent on various underground forums and marketplaces**.
Edmund Brumaghin, threat researcher at Cisco Talos said they assess with moderate confidence that **multiple entities are modifying the code base of SapphireStealer to support additional data exfiltration mechanisms ** leading to the creation of several variants.
The newly compiled versions of the malware began "**being uploaded to public malware repositories** beginning in mid-January 2023, **with consistent upload activity** being observed through the first half of 2023."
Researchers observed that the malware samples are currently **being used by multiple threat actors and various variants** of this threat are already in the wild with threat actors improving its efficiency and effectiveness over time.
The malware is **capable of stealing sensitive information** from infected systems including host information, screenshots, cached browser credentials and files stored on the system that match a predefined list of file extensions. It also attempts **to determine the presence of credential databases for browser applications including Chrome, Yandex, Edge and Opera**.
Once executed, the malware creates a working directory, and a **file grabber executes and attempts to locate any files stored within the victim's Desktop folder** that match a list of file extensions including .txt, .pdf, .doc, .docx, .xml, .img, .jpg and .png.
The malware then **creates a compressed archive called ** [**log.zip**](http://log.zip) containing all of the logs and the data is **transmitted to the attacke**r via Simple Mail Transfer Protocol "using credentials defined in the portion of code responsible for crafting and sending the message."
When the logs are successfully exfiltrated, the **malware deletes the working directory created earlier and terminates execution**.
"One of the byproducts of readily available and open source malware codebases is that ** the barrier to entry into financially motivated cybercrime has continued to decrease over time**"
Stealers enables attackers **with less operational expertise to conduct an attack**, but it can be extremely damaging to corporate environments as the data stolen is often leveraged for additional attacks later.