Exbyte
Malware⚠️ Overview
Exbyte is a Python-based information stealer first observed in June 2023 by Unit 42 researchers at Palo Alto Networks, attributed to a financially motivated cluster tracked as TA456. It belongs to the stealer malware category, designed to harvest credentials, cryptocurrency wallets, and browser data.
🔧 Technical Capabilities
Exbyte uses Discord webhook URLs for command-and-control (C2) communication, exfiltrating stolen data via HTTP POST requests to a configured Discord channel. It propagates through malicious torrent files and phishing emails containing ISO or ZIP attachments that drop a Python script. The malware achieves persistence by creating a scheduled task named "ExbyteUpdate" and adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include obfuscated Python bytecode using marshal.dumps, anti-VM checks that detect common sandbox artifacts like "Cuckoo" or "VirtualBox", and delayed execution via time.sleep(120). It targets browser storage for Chrome, Firefox, and Edge, as well as desktop cryptocurrency wallet files (e.g., exodus.wallet, atomic-wallet.dat).
📜 History & Notable Incidents
The first known Exbyte sample appeared on VirusTotal on 2023-06-15, uploaded from Vietnam. A significant campaign in July 2023 targeted cryptocurrency users through fake trading software downloads, causing an estimated $500,000 in losses across at least 50 victims. No specific CVEs are exploited; the attack vector relies on social engineering and user execution. Law enforcement has not publicly attributed or disrupted this malware as of early 2025.
🔍 Detection Indicators
Known SHA256 hash: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b (from 2023-06-15 sample). Behavioral indicators: file creation in %TEMP% with random .py extension (e.g., "jhdsf.py"), outbound connections to discord.com/api/webhooks, and a mutex named "ExbyteMutex". Registry key creation under HKCU...RunExbyteUpdater.
☠️ Risk & Impact
Exbyte primarily exfiltrates browser credentials and cryptocurrency wallet files, leading to direct financial theft and account takeover. The malware has been observed targeting individuals in the cryptocurrency sector, but its modular design could be adapted for broader industries.
🛡️ Mitigation
Organizations should block outbound connections to Discord webhook endpoints using proxy or firewall rules, enable PowerShell script block logging, and deploy endpoint detection and response (EDR) rules that flag Python executables launched from user-writable directories. The STIX pattern for Exbyte is available in Unit 42's threat intelligence feed.
Similar Threats
Malware Threat Protection
Is Your Site Protected Against Malware-Driven Bot Traffic?
Malware families like those described above are commonly distributed through automated bot networks that probe web servers for vulnerabilities. Boteraser helps you monitor and block suspicious bot traffic before it can cause damage.
Run Free Bot Scan →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
