What is ViperSoftX Malware? How to Protect from ViperSoftX Malware?

Google Chrome is a popular open-source browser used to access the internet and run multiple web applications; It is one of the most trustable browsing platforms all around the world. Even so, there are multiple attacks targeting google chrome, as it is the best place to steal credentials or other sensitive information.

In this article, we will discuss one of the wildly exploited attacks where the Google chrome extension was seen used as a cryptocurrency stealer, ViperSoftX Malware. Let’s see what is ViperSoftX Malware, how ViperSoftX Malware is misused as a cryptocurrency stealing Google chrome extension, and how to protect from ViperSoftX Malware.

What is a google chrome extension? Are they safe?

A google chrome extension is nothing but a software program that enhances user experience by providing customized features. Chrome extensions are built on web technologies such as CSS, HTML, and JavaScript.

A vast majority of extensions are considered safe however the concern is when it comes to permission, as it can access sensitive and critical information. They can be a potential attack vector if not managed correctly. Let’s look into one such case.

What is VipersoftX Malware?

ViperSoftX is a Windows malware that deploys a Google Chrome extension named ‘VenomSoftX’. This is an information stealer malware with very interesting obfuscation capabilities. ViperSoftX is a JavaScript-based RAT (remote access trojan), it was initially observed in the early 2020s, but these malwares have grown extensive and is being actively exploited recently.

ViperSoftX is mostly distributed via cracked software like Microsoft Office, Adobe illustrator, etc. These are also spread via torrent downloads. Only windows users have been impacted so far.

Recent Campaign Activity – Victims of ViperSoftX Malware Campaign

As per Avast, they have protected more than 93,000 users from this malware. This malware is distributed all around the world, mostly via torrent files or software-sharing sites. The most impacted countries are India (7,000+), the USA (6,000+), and Italy (5,000+).

Impacted countries since the beginning of 2022 Source: Avast

As of 8th November 2022, a total of $130,421.56 have been stolen by ViperSoftX and VenomSoftX from stolen cryptocurrencies. The below table shows an estimate of attacker earnings from multiple cryptocurrency wallets.

Source: Avast

How Does ViperSoftX Malware Campaign Work?- Attack Flow

This section is more focused on how ViperSoftX Malware is misused as a Cryptocurrency Stealing Google Chrome extension.

ViperSoftX pretends to be a cracked software as the victim downloads it. This malware is commonly named patch.exe or activator.exe. Activator.exe is the loader that decrypts data from itself using AES, the decrypted loader reveals five different files:

The log file will usually be more than 5 MB and contains a single malicious line of code. This file will be stored under different names such as “driver” or “log” or a “text” file.

ViperSoftX malware is very skilled in hiding itself. Before executing the payload, it is protected by 8 layers of code obfuscation. 3 major types of obfuscation techniques used are:

ViperSoftX achieves persistence by creating a copy of itself in %APPDATA%. The attacker also tries to make it look trustable by using legitimate names such as vpn_port.dll, and install.sig etc. The malware also drops another script file and creates a shortcut in the startup directory to invoke it. This is a VBS script file that later executes ViperSoftX.

Features of ViperSoftX Malware

The primary features of ViperSoftX include the following,

As we already mentioned, one of the critical payloads used by ViperSoftX is the chromium-based browser extension VenomSoftX. This extension has multiple unique features which provide complete access to every website the victim visit. It also could execute man-in-the-browser attacks to steal cryptocurrency by tampering with crypto addresses (API request tampering) on popular cryptocurrency exchanges. The stolen information and fingerprint are concatenated into one string, further encoded by base 64, and is shared with the hardcoded C&C server.

ViperSoftX scans the copied clipboard text content using predefined regular expressions, and if the expression matches any configured wallet address, the malware replaces the content with the attacker address notification to command and control. This is done in the X-notify HTTP header in the below format ‘Cryptocurrency type – victim’s address – attacker’s address.’

The attacker hides the malware as a chrome browser extension masqueraded as “Google Sheets 2.1” which is supposed to be a google productivity app.

Malicious extension (Credits: Avast)

ViperSoftX as a RAT (Remote Access Trojan)

ViperSoftX also provides RAT functionalities such as executing arbitrary commands downloading arbitrary payloads and executing itself, removing itself entirely from the system, etc. The malware can create an infinite loop and execute commands after every 3 seconds of sleep.

ViperSoftX passes information to the CNC server via the HTTP header, Where it provides OS information, computer name, username, etc. The commands implemented by ViperSoftX are:

Source: Fortinet

As observed by Fortinet, the malware author continue to use multiple JavaScript-based payloads. This shows that the developer is more comfortable using JavaScript as his preferable programming language.

How to protect from ViperSoftX Malware?

JavaScript-based malware are on trend now, and the obfuscation capability of this malware is amazing. While the functionality is simple. If closely monitored, VipersoftX Malware can be detected easily, as it uses plaintext communication using a header, as it will stand out from regular traffic.

Any communication with the IOCs mentioned should be monitored closely to avoid damage to the organization.

Indicator of Compromise (IOC) of ViperSoftX Malware

SHA256 –

ViperSoftX 

VenomSoftX

C&C communication

MITRE Techniques

List of wallet addresses

We hope this article helped in understanding what is ViperSoftX Malware, how ViperSoftX Malware is misused as a cryptocurrency stealing Google chrome extension, and how to protect from ViperSoftX Malware. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.