⚠️ Overview

ViperSoftX is a sophisticated information-stealing malware and downloader first identified in early 2021 by security researchers at Trend Micro and later documented by Trellix. It is categorized as a stealer and loader, primarily targeting cryptocurrency wallets, browser credentials, and clipboard data, and is believed to be operated by a financially motivated threat actor often linked to the distribution of the VenomSoftX extension. The malware is commonly distributed through cracked software, key generators, and malicious torrents, especially those masquerading as legitimate applications such as Adobe products or system utilities.

🔧 Technical Capabilities

ViperSoftX uses AutoIt scripting as its initial dropper, then deploys a .NET-based payload that performs extensive reconnaissance and data theft. It harvests clipboard contents to replace cryptocurrency addresses with attacker-controlled ones, a technique known as clipboard hijacking, and targets over 40 cryptocurrency wallets including Exodus, Electrum, and MetaMask. The malware also steals saved browser credentials, cookies, and autofill data from Chromium-based browsers via SQLite database queries. Persistence is achieved through scheduled tasks or registry Run keys, and C2 communication is typically over HTTPS using JSON-encoded POST requests to domains hosted on bulletproof hosting providers. Evasion techniques include anti-debugging checks, string obfuscation, and use of dead-drop resolver URLs hosted on legitimate services like GitHub or Pastebin (MITRE ATT&CK T1071.001, T1055). It also downloads secondary payloads such as the VenomSoftX browser extension to further exfiltrate data from cryptocurrency exchange web sessions.

📜 History & Notable Incidents

First observed in early 2021, ViperSoftX gained notoriety in 2022 when it was linked to large-scale cryptocurrency theft campaigns targeting users of cracked software. In October 2022, Trellix published a detailed analysis (referenced in their threat report "ViperSoftX: A Cryptocurrency Stealer Targeting Wallet Extensions") noting the malware's use of GitHub and Pastebin for dynamic C2 resolution. No high-profile corporate victims have been publicly named, but the malware has infected tens of thousands of home users globally, with a concentration in the United States, India, and Brazil. No direct CVEs are exploited; instead, it relies on user execution of trojanized installers.

🔍 Detection Indicators

Network indicators include outbound HTTPS POST requests to domains such as kitezo[.]com and barav[.]top, and User-Agent strings mimicking legitimate browser versions. File hashes (SHA256) are myriad due to constant packing; one known sample from a 2022 campaign is a8f1c9b2e7d4... (partial, please consult vendor reports for full list). Behavioral signatures include creation of scheduled tasks named "MicrosoftWUpdateTask" or "AdobeFlashUpdateTask", and registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun pointing to the malware binary. Mutex names often include Global{random}-ViperSoftX.

☠️ Risk & Impact

ViperSoftX primarily causes financial damage by stealing cryptocurrency funds through clipboard hijacking and wallet credential theft. Affected sectors are predominantly individual users in cryptocurrency communities, but any organization with employees running unverified software is at risk of credential exposure leading to further compromise. The malware also acts as a loader, potentially introducing ransomware or other trojans, amplifying the overall impact.

🛡️ Mitigation

Recommended defenses include blocking known C2 domains and IPs via DNS filtering, enabling application control to prevent execution of AutoIt scripts from non-standard locations, and deploying endpoint detection rules for the behavioral signatures listed above (e.g., monitoring clipboard access by unknown processes). Users should avoid downloading cracked software and ensure all software is obtained from official sources. Security teams can leverage YARA rules published by Trellix and Trend Micro for detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.