Sbz

SBZ is a potent malware, also known as a filestealer, that has been identified by cybersecurity researchers. It is characterized by its ability to upload any recent file matching a hardcoded set of extensions (.doc, .docx, .pdf, .rar, etc.) to the Command and Control (C2) server. Its discovery was facilitated by signatures associated with the Equation malware family, and it shares coding style and practices with this notorious group. The SBZ malware's SHA-256 hash is 80721e6b2d6168cf17b41d2f1ab0f1e6e3bf4db585754109f3b7ff9931ae9e5b, further aiding in its identification and tracking. The malware's coding style and practices bear a striking resemblance to those seen in STRAITBIZARRE (SBZ), an espionage platform suspected to be linked to a U.S.-based adversarial collective. However, despite the similarities, it has been clarified that the two are completely unrelated. The data format, naming convention, and URL scheme used by the C2 server (/h/pa) are also very similar to the SBZ filestealer, adding to the complexity and sophistication of the malware. In addition to the SBZ filestealer, malicious tools observed in related attacks include Tomiris downloader, download scheduler, .NET downloader and implant, Telemiris backdoor, Roopy stealer, JLORAT backdoor, JLOGRAB stealer, RATel open source RAT, Python Meterpreter loader, and Warzone commercial RAT. These findings underscore the extensive capabilities and potential threat posed by the SBZ malware and its associated cyberespionage activities.