ViperSoftX Weaponizing AutoIt & CLR For Stealthy PowerShell Execution

ViperSoftX is an advanced malware that has become more complicated since its recognition in 2020, to the extent that eBooks are used on Torrent sites to spread across systems. 

Unlike other kinds of malware developers who mainly focus on developing new code instead of improving evasion techniques, ViperSoftX’s creators make use of various components from offensive security scripts.

Due to this, ViperSoftX is a major threat to users who want to have effective countermeasures.

It needs a significant comprehension of its infection chain, payload execution as well and stealth techniques for the development of strong preventive measures.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

Cybersecurity researchers at Trellix recently discovered that the newest variant of the malware uses CLR (Common Language Runtime) to load PowerShell commands into AutoIt dynamically and, in turn, improves its own evasive abilities and for stealthy PowerShell execution.

ViperSoftX Weaponizing AutoIt & CLR

It all begins when victims download what looks to be a legitimate book from a rogue torrent.

This RAR archive contains hidden threats such as a folder, deceptive shortcut files, and scripts that pretend to be pictures.

When the shortcut is run, it triggers a series of commands that uncover the hidden folder, name the sizes for the disk in a specific manner, create enduring Windows tasks, and drop hidden AutoIt scripts into the operating system.

This complex multi-stage attack leverages file obfuscation and automation to deploy malware while evading detection.

Researchers said it leverages AutoIt’s ability to interact with the .NET CLR framework, enabling PowerShell command execution.

The malware employs advanced mechanisms to evade AMSI, decrypt multi-layered payloads, and collect information from the system to target cryptocurrency wallets.

Afterward, the data, including highly detailed user system information, is sent to its C2 server through false hostnames and Base64-encoded user agents.

Through this layered evasion technique and legitimate traffic blending, ViperSoftX can successfully penetrate targeted systems without detecting or stealing cryptocurrencies.

To send collected data to a remote server, the pOPSKX function establishes a web client, sets up headers, and sends an abnormal POST request with a content length of 0 for avoidance.

It then checks the “worker” header of the server to determine if there is a need for more work and whether the global worker variable should be true or false.

There are also Cloudflare services that obfuscate where the traffic comes from, making it impossible to trace.

The viperSoftx malware itself finds relevant information, takes note of it, and shares this data with command and control (C2) servers.

Then, it performs screen captures on screenshots in the Windows systems clipboard, looks for other payloads on the internet, runs reconnaissance tools or utilities against targets, and uses a self-destruction mechanism where necessary.

With CLR, PowerShell can be run in AutoIt to evade detection and patching Antimalware Scan Interface (AMSI).

Understanding ViperSoftX’s tactics and developing comprehensive defenses can mitigate its threat.

“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo