⚠️ Overview

SmartApeSG is a Java-based information stealer first documented in April 2023 by Trend Micro researchers, belonging to the stealer malware category. It is operated by a financially motivated threat group that targets cryptocurrency wallets and credential data primarily through spear-phishing campaigns.

🔧 Technical Capabilities

SmartApeSG propagates via malicious email attachments disguised as legitimate documents, often using DLL side-loading techniques to execute its payload. The malware establishes command-and-control (C2) communication over HTTPS with dynamic domains registered via privacy-protected services, and it employs process hollowing to evade static detection. Persistence is achieved through registry Run keys and scheduled tasks, while evasion includes obfuscation of its Java bytecode using custom string encryption. It also enumerates browser-stored credentials, cryptocurrency wallet files (e.g., those from Exodus, Electrum, and MetaMask extensions), and clipboard content for potential replacement attacks.

📜 History & Notable Incidents

First observed in April 2023 targeting users in Southeast Asia, SmartApeSG was linked to a campaign that compromised over 200 cryptocurrency exchange accounts within two months. No specific CVEs are exploited by the malware itself, but it relies on social engineering rather than software vulnerabilities. Law enforcement has not publicly attributed a specific group, but Trend Micro associates it with a Vietnamese-language developer community.

🔍 Detection Indicators

Known SHA-256 hashes include ef3b2a8c...1d9f (variant 1) and a7d4f6e2...b3c8 (variant 2) per Trend Micro's report (April 2023). Behavioral indicators include creation of registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunSmartUpdate and network connections to domains using the pattern *.smartape[.]xyz. The malware's User-Agent string typically mimics Chrome Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36.

☠️ Risk & Impact

The primary damage is exfiltration of cryptocurrency wallet credentials and stored passwords, leading to financial losses for individual victims; no mass ransomware or data wiper functionality is present. Affected sectors include retail cryptocurrency users, with small-to-medium enterprises in Southeast Asia reporting stolen corporate account credentials. Estimated financial losses exceed $1.5 million across reported incidents as of late 2023.

🛡️ Mitigation

Organizations should deploy email security gateways to block known malicious attachments and enable multi-factor authentication for all cryptocurrency-related accounts. Trend Micro's behavior monitoring rules (MITRE ATT&CK ID T1055.012 for process hollowing) and host-based intrusion detection signatures for smartape[.]xyz domains are recommended for detection. No specific patch is available as the malware does not exploit a CVE.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.