WasabiSeed (f3b7e302-152b-4c4e-85c2-82733b78d13f)
According to Proofpoint, WasabiSeed is a simple VBS downloader which repeatedly uses Windows Installer to connect to the C2 server looking for MSI packages to download and run. Proofpoint showed that it downloads and executes first a second MSI file containing Screenshotter.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| SunSeed (54c03b3c-6f97-46ea-a93f-f07bfd5cdd36) | Tool | WasabiSeed (f3b7e302-152b-4c4e-85c2-82733b78d13f) | Tool | 1 |
| SunSeed (a89f7e01-b049-4d09-aca3-ce19d91c4544) | Malpedia | SunSeed (54c03b3c-6f97-46ea-a93f-f07bfd5cdd36) | Tool | 2 |