Seqrite Details Multi-Stage Stealer Campaign Targeting Thailand’s Healthcare Sector
Summary
Seqrite TRU describes a healthcare-themed phishing campaign using obfuscated batch loaders, Startup-folder persistence and a Python stealer to harvest browser data. Attempts to exfiltrate data through the Telegram Bot API failed due to connectivity timeouts.
Key points
- Seqrite TRU reports a campaign targeting Thailand’s healthcare personnel and organizations with spear-phishing lures delivered in malicious RAR archives.
- The investigated infection chain uses obfuscated batch loaders, a Rouki-obfuscated payload, GitHub-hosted files and a Startup-folder script for persistence.
- The Python payload sim.py targets browser data, stored credentials and session information, then stages collected data in ZIP archives.
- The stealer attempted to transmit data through the Telegram Bot API, but observed requests to api[.]telegram[.]org failed due to connectivity timeouts.
- Samples observed from April 7 to June 3, 2026, used healthcare- and government-themed lures tailored to roles including procurement, administration and clinical staff.
- Seqrite says the samples were uploaded from Thailand, which may indicate local staging infrastructure or compromised local systems; it could not definitively attribute the campaign.
Article Details
- Attack Vectors
- Healthcare-themed spear-phishing delivered malicious RAR archives containing obfuscated batch scripts and executable payloads.
- Batch loaders used PowerShell and cmd commands to decode and execute additional stages, including payloads retrieved from GitHub-hosted URLs.
- A downloaded batch script was placed in the Windows Startup folder for execution at user logon; another batch payload attempted to relaunch with elevated privileges.
- The final Python payload terminated browsers, harvested browser data and credentials, staged and compressed collected data, and attempted exfiltration through the Telegram Bot API.
- Defensive Notes
- Remain vigilant for document-themed phishing campaigns targeting healthcare personnel.
- Monitor for unauthorized modifications to Windows Startup folders.
- Restrict execution of untrusted scripts and binaries obtained from external sources.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 442e0f4e822842922e7e4685840194e99fd68c7f0ec38c1925914b8f724d5865 | SHA-256 hash of the SIM.PY information-stealer sample. |
| SHA256 | 4eebc38297a307d18784d6f9ebc8aa6e6f69860be970cc70d9e544deb1ff6ce0 | SHA-256 hash of the malicious Health_Ministry_Approved_Equipment_2026.bat loader. |
| SHA256 | 523388567630e4fbdc359f75232bf2ad82671a680d4bfdce0237fc30dfec4c80 | SHA-256 hash of Desktops.zip, the archive containing the staged payload. |
| SHA256 | 74bb6ad7e1310f30a3e24fd3cbbffa2c0c41c64e89e5d0dd1d6900e96b914183 | SHA-256 hash of WindowSecuryt.bat, the malicious Startup persistence script. |
| SHA256 | 7709d8c34d490509f3624104611eb75a862944dd9d7a642f44514ada16c85ee9 | SHA-256 hash of the malicious u-t2.bat secondary payload. |
| SHA256 | e5f6d9d405819e6b05b5d8268a2e973294859ad65237ede36ab612b536d0ac2b | SHA-256 hash of the malicious Health_Ministry_Approved_Equipment_2026.rar archive. |
| SHA256 | f4d4b8cac004bb63834c6df436721babd9464c09787c80b268d839e0aada9f87 | SHA-256 hash of the obfuscated payload.bat loader. |
| URL | hxxps[:]//github[.]com/d7-te/vtn/raw/main/T2.zip | GitHub-hosted URL used to download the ZIP archive containing the information stealer. |
| URL | hxxps[:]//github[.]com/ud-7-te/ud-vtn/raw/main/up-t2.png | GitHub-hosted payload URL used to retrieve the file masquerading as a PNG and install it as the Startup script. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/ud-7-te/ud-vtn/main/ud-t2.txt | GitHub-hosted URL used to download the malicious u-t2.bat payload. |
MITRE ATT&CK
T1005 · Data from Local SystemThe Python stealer collected browser-related data and staged it in temporary directories.T1027 · Obfuscated Files or InformationBatch loaders used obfuscation and junk data to conceal their execution logic.T1036 · MasqueradingPayloads were disguised as PNG and TXT files and healthcare-related documents.T1059.001 · PowerShellPowerShell decoded embedded payload content, downloaded files, and launched later stages.T1059.003 · Windows Command ShellBatch files and cmd commands downloaded and executed subsequent payloads.T1070.004 · File DeletionThe loaders deleted temporary artifacts and the downloaded ZIP archive after use.T1102 · Web ServiceThe campaign used GitHub to host payloads for retrieval by the loaders.T1105 · Ingress Tool TransferThe loaders retrieved additional payloads from GitHub-hosted URLs.T1204.002 · Malicious FileOpening the lure archive triggered the infection chain.T1547.001 · Registry Run Keys / Startup FolderWindowSecuryt.bat was placed in the Windows Startup folder to run at user logon.T1548 · Abuse Elevation Control MechanismThe u-t2.bat script attempted to relaunch itself with elevated privileges.T1555.003 · Credentials from Web BrowsersThe stealer targeted browser credentials, cookies, and session data after terminating browsers.T1560 · Archive Collected DataThe payload compressed harvested data into ZIP archives before attempted exfiltration.T1566.001 · Spearphishing AttachmentThe campaign delivered healthcare-themed spear-phishing lures as malicious RAR attachments.T1567.002 · Exfiltration to Cloud StorageThe stealer attempted to send stolen data through Telegram Bot API requests; the reported attempts failed due to connectivity timeouts.
Products
Brave[T1555.003] Credentials from Web Browsers – The malware specifically terminated browsers to access browser databases and cookies (‘Google Chrome, Microsoft Edge, Brave’).GitHubtargeting Thailand’s healthcare sector with spear-phishing RAR archives, obfuscated batch loaders, GitHub-hosted payloads, and a Python stealer that attempts Telegram-based exfiltration.Google Chrome[T1555.003] Credentials from Web Browsers – The malware specifically terminated browsers to access browser databases and cookies (‘Google Chrome, Microsoft Edge, Brave’).Microsoft Edge[T1555.003] Credentials from Web Browsers – The malware specifically terminated browsers to access browser databases and cookies (‘Google Chrome, Microsoft Edge, Brave’).TelegramRAR archives, obfuscated batch loaders, GitHub-hosted payloads, and a Python stealer that attempts Telegram-based exfiltration.