{
  "family": "separ",
  "sample_count": 5,
  "category": "trojan",
  "description": "Trojan:Win32/Separ is an aggressive credential-stealing malware campaign renowned for its simplicity, effectiveness, and its heavy reliance on legitimate, 'dual-use' utilities to evade antivirus detection. Separ does not use complex zero-day exploits or advanced rootkit techniques; instead, it uses basic batch scripting and readily available administrative tools to rapidly harvest credentials from browsers and email clients.<br><br><b>Understanding Separ (Living off the Land)</b><br>To an end-user, a Separ infection might look like a fleeting command prompt window opening and closing instantly. For a SOC analyst, Separ is a prime example of 'Living off the Land' (LotL) tactics. Because it uses legitimate tools (like NirSoft utilities) to do the actual stealing, traditional signature-based AV often fails to block the activity, assuming the tools are being used by a legitimate administrator.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Separ is typically distributed via spear-phishing emails containing malicious PDF attachments with embedded links, or ZIP files containing a deceptive `.exe` (which is often a self-extracting archive or a compiled batch script) (`T1566.001`). When executed (`T1204.002`), it drops a series of batch files (`.bat`), VBScript files, and legitimate password recovery tools (like `WebBrowserPassView.exe` or `MailPassView.exe`) into a hidden directory. It then uses the batch scripts to silently execute these tools, dumping all saved passwords from Chrome, Firefox, Edge, Outlook, and Thunderbird into a text file (`T1555.003`). The script then uses a command-line FTP client (like `ftp.exe`) to exfiltrate the text file to a compromised server controlled by the attacker (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the immediate compromise of all local user credentials. Host-based IoCs include EDR alerts for `cmd.exe` or `wscript.exe` launching known password recovery tools (NirSoft, etc.) from the `%Temp%` or `%AppData%` directory. Network IoCs include outbound FTP connections to unknown or suspicious IP addresses, transferring `.txt` files containing harvested credentials.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1048.003",
    "T1555.003",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1048.003",
      "name": "Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (FTP)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Assume all passwords stored in web browsers or email clients on the infected machine have been compromised, and force immediate enterprise-wide password resets.",
    "Isolate the endpoint to prevent further exfiltration of data.",
    "Review firewall logs to identify the destination IP address used by the FTP exfiltration script, and block it network-wide.",
    "Implement Application Control (like AppLocker or Windows Defender Application Control) to explicitly block the execution of known dual-use password recovery tools."
  ],
  "what_to_avoid": [
    "Do not assume the network is safe just because the AV deleted the initial dropper; the credential harvesting happens in seconds, and the data is likely already gone.",
    "Avoid ignoring alerts for 'Potentially Unwanted Programs' (PUAs) like NirSoft tools, as they are frequently weaponized by campaigns like Separ."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}