Separ

Overview

Trojan:Win32/Separ is an aggressive credential-stealing malware campaign renowned for its simplicity, effectiveness, and its heavy reliance on legitimate, 'dual-use' utilities to evade antivirus detection. Separ does not use complex zero-day exploits or advanced rootkit techniques; instead, it uses basic batch scripting and readily available administrative tools to rapidly harvest credentials from browsers and email clients.

Understanding Separ (Living off the Land)
To an end-user, a Separ infection might look like a fleeting command prompt window opening and closing instantly. For a SOC analyst, Separ is a prime example of 'Living off the Land' (LotL) tactics. Because it uses legitimate tools (like NirSoft utilities) to do the actual stealing, traditional signature-based AV often fails to block the activity, assuming the tools are being used by a legitimate administrator.

Execution and Credential Harvesting Mechanics
Separ is typically distributed via spear-phishing emails containing malicious PDF attachments with embedded links, or ZIP files containing a deceptive `.exe` (which is often a self-extracting archive or a compiled batch script) (`T1566.001`). When executed (`T1204.002`), it drops a series of batch files (`.bat`), VBScript files, and legitimate password recovery tools (like `WebBrowserPassView.exe` or `MailPassView.exe`) into a hidden directory. It then uses the batch scripts to silently execute these tools, dumping all saved passwords from Chrome, Firefox, Edge, Outlook, and Thunderbird into a text file (`T1555.003`). The script then uses a command-line FTP client (like `ftp.exe`) to exfiltrate the text file to a compromised server controlled by the attacker (`T1048.003`).

Indicators of Compromise & Impact
The impact is the immediate compromise of all local user credentials. Host-based IoCs include EDR alerts for `cmd.exe` or `wscript.exe` launching known password recovery tools (NirSoft, etc.) from the `%Temp%` or `%AppData%` directory. Network IoCs include outbound FTP connections to unknown or suspicious IP addresses, transferring `.txt` files containing harvested credentials.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_SEPAR_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Separ"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "separ" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Separ (Trojan) Execution & Triage
id: 6123daa5-afe3-50d8-977b-630a2f3019c1
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Separ malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/separ
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1566_001
- attack.t1048_003
- attack.t1555_003
- attack.t1059_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_SEPAR_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Separ tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "separ" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Assume all passwords stored in web browsers or email clients on the infected machine have been compromised, and force immediate enterprise-wide password resets.
2. Isolate the endpoint to prevent further exfiltration of data.
3. Review firewall logs to identify the destination IP address used by the FTP exfiltration script, and block it network-wide.
4. Implement Application Control (like AppLocker or Windows Defender Application Control) to explicitly block the execution of known dual-use password recovery tools.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the network is safe just because the AV deleted the initial dropper; the credential harvesting happens in seconds, and the data is likely already gone.
2. Avoid ignoring alerts for 'Potentially Unwanted Programs' (PUAs) like NirSoft tools, as they are frequently weaponized by campaigns like Separ.

References & External Analysis

• Search "separ" on VirusTotal (External Analysis)
• Search "separ" on Any.Run (Sandbox Sandbox)
• Search "separ" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Antidenial
• Mudrop
• Habbo
• Confucius
• Ircbrute
• Cryptominer
• Vmprotbad
• Guagua

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/separ.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.