Information stealing malware has become increasingly popular among malware authors targeting not just typical end-users, but also specific organizations and states. We have come across an intriguing piece of malware (dubbed Sayad) that implements multiple host data collection methods and wraps them up into a single .NET DLL. Sayad malware is typically distributed through phishing emails.