: It modifies registry keys in HKCU\Software\Microsoft\Windows\CurrentVersion\Run and Winlogon to ensure it restarts every time the computer boots. Forensic Indicators (IOCs)
Based on threat intelligence reports, is a generic name frequently used by various malware families and threat actors, most notably associated with ransomware deployment and information theft. Malware Identity and Context Soft.exe
: The malware frequently uses CryptOne packing to hide its code and implements stalling techniques (like calling Sleep functions) to wait out sandbox analysis. : In more recent activity, a related variant
: In more recent activity, a related variant named ViperSoftX has been found disguised as cracked software to steal cryptocurrency and system information. : It is known to inject malicious code
Nuclear Exploit Kit (EK), cracked software, or malicious torrents File encryption (Ransomware) or theft of crypto-wallet data Detection High malicious score (100/100) in automated analysis Threat Roundup for August 12 to August 19
According to analysis from Joe Sandbox and Hybrid Analysis , typical indicators include: : E4272FB1E61D3D995EEA488931E815AF . File Paths : Often found in %TEMP% or on the %DESKTOP% .
: It is known to inject malicious code into legitimate Windows processes like svchost.exe to operate stealthily in memory.