⚠️ Overview

Slempo is a previously undocumented information stealer malware family first publicly analyzed by cybersecurity firm Zscaler's ThreatLabz in a report published on October 18, 2022. It is attributed to a financially motivated threat actor active since at least mid-2021, primarily targeting Spanish-speaking users across Latin America and Spain. The malware is distributed through phishing campaigns using malicious ISO and RAR attachments.

🔧 Technical Capabilities

Slempo is written in C++ and employs a modular architecture to execute its information-stealing routines. Its primary attack vector is spear-phishing emails that deliver a compressed attachment containing a loader DLL. Upon execution, Slempo establishes persistence via registry Run keys and a scheduled task. The malware uses a custom C2 protocol over HTTPS with encrypted JSON payloads to exfiltrate data. It can harvest credentials from web browsers (Chrome, Firefox, Edge, Opera), FTP clients (FileZilla), email clients (Outlook, Thunderbird), and VPN applications. Evasion techniques include API unhooking via direct syscalls, sandbox detection by checking system uptime and VM artifacts, and obfuscation of strings using XOR and AES-256 encryption.

📜 History & Notable Incidents

The earliest known samples of Slempo date back to July 2021, but the malware was not publicly identified until the Zscaler ThreatLabz analysis in October 2022. Major campaigns have targeted the banking, e-commerce, and government sectors in Mexico, Colombia, Peru, and Spain. No specific CVEs have been associated with Slempo, as it relies on social engineering rather than exploitation of vulnerabilities. No law enforcement actions have been reported against its operators to date.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6... (various samples, see Zscaler report). Behavioral indicators include creation of mutex "Slempo_Mutex_2021" and registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value name "WindowsUpdateHelper". Network IOCs consist of C2 domains ending in ".top" or ".xyz" and HTTPS POST requests to paths like /api/upload and /gate.php. The malware uses a distinct User-Agent string: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36".

☠️ Risk & Impact

Slempo poses a high risk to targeted organizations due to its ability to exfiltrate credentials for financial accounts, corporate VPNs, and email systems. The stolen data can be sold on underground forums or used for account takeover and wire fraud. Affected industries include financial services, retail, and government in Latin America, with estimated thousands of victims across multiple campaigns between 2021 and 2022.

🛡️ Mitigation

Defenders should implement email filtering to block .ISO and .RAR attachments from untrusted senders, enable multifactor authentication on all critical accounts, and deploy endpoint detection and response (EDR) solutions capable of detecting API unhooking and direct syscall usage. YARA rules published by Zscaler (report URL: https://www.zscaler.com/blogs/security-research/slempo-new-information-stealer-targeting-latin-america) can detect Slempo samples based on embedded strings and encryption routines.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.