{"id":51588,"date":"2023-04-24T00:00:00","date_gmt":"2023-04-24T00:00:00","guid":{"rendered":"urn:uuid:41f90848-ff04-b502-9b5b-268b079245b9"},"modified":"2023-04-24T00:00:00","modified_gmt":"2023-04-24T00:00:00","slug":"vipersoftx-updates-encryption-steals-data","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/vipersoftx-updates-encryption-steals-data\/","title":{"rendered":"ViperSoftX Updates Encryption, Steals Data"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Figure 11. Top 10 countries affected by ViperSoftX malware in the enterprise (top) and consumer (bottom) sectors
Source: Trend Micro Smart Protection Network (SPN)<\/p>\n

Conclusion and insights<\/span><\/p>\n

While other cybercriminals use sideloading to load another non-binary component (usually the encrypted payload, which comes together as a package with the normal executable and the sideloaded DLL), the chosen techniques of the actors behind ViperSoftX (which involve using WMI Query Language (WQL), DLL sideloading\/DLL load order hijacking, PowerShell reflective loading, browser hijacking, and C&C protection) are sophisticated.<\/p>\n

The cybercriminals behind ViperSoftX are also skilled enough to execute a seamless chain for malware execution while staying under the radar of authorities by selecting one of the most effective methods for delivering malware to consumers. Although we have observed some changes throughout their campaigns, the pace of ViperSoftX\u2019s development can be considered slow compared to other types of stealer malware.<\/p>\n

The group behind this malware has been doing this for a number of years, and it knows its target systems based on the simultaneous use of techniques to steal cryptocurrencies and passwords. In this respect, we believe there are actually at least two groups responsible for this ViperSoftX campaign based on the malware\u2019s C&C communication. As the first set of players, the main group is responsible for the deployments. On the other hand, considering the monthly change of C&C servers and communication exchange, we believe in the possibility of another group involved based on the different coding or C&C scheme. ViperSoftX uses a domain-generating algorithm (DGA) to hide its C&C server and generate useless traffic. From the DGA technique, we observed that majority of the activities are dominated by the main group, which utilizes a simple DGA. However, there are a number of activities that appear to use a different DGA. We do not discount the possibility that these can either be older samples or different operators entirely.<\/p>\n

While ViperSoftX appears to be targeting consumers considering its chosen means for entry, we found it interesting that it also affects the business sector. One possible theory behind why businesses are affected by this campaign has to do with recent layoffs and possible budget cuts. While some users might be looking to freelance and upend their incomes while in between jobs, others might have been prompted to download tools from unofficial platforms to \u201csave costs\u201d and circumvent tools not found in office-issued devices. Nonetheless, we strongly recommend that users download the software and applications they need from official platforms. Cracks and other illegally owned software will only work for certain periods since majority of license verification methods are now done in the cloud. If features such as updates to circumvent the replacement of cracks or patches are disabled, users would then be putting their respective systems at greater risk of attacks or infections.<\/p>\n

Here are some additional recommendations to prevent the risks of infection from malware types like ViperSoftX:<\/p>\n