Ankura CTIX FLASH Update - July 12, 2024

Ransomware/Malware Activity

ViperSoftX Malware Exploits AutoIT and CLR to Covertly Run PowerShell Scripts

Researchers at Trellix have observed a new variant of the ViperSoftX information-stealing malware which has been hosted on malicious torrent sites. The ViperSoftX malware hides in a RAR file download purporting to contain a helpful e-book but instead contains a decoy PDF file, a shortcut, and PowerShell scripts disguised as JPG images. The shortcut file begins the infection chain once clicked, which initiates a command sequence to list the contents of the disguised JPG files, which include concealed PowerShell code. The PowerShell code then performs actions to configure Windows Task Scheduler to run an AutoIt script every five minutes after log-in to maintain persistence. Researchers observed that the AutoIt executable uses the common language runtime (CLR) to load and execute PowerShell commands. CLR is a component of Microsoft's .NET Framework, which helps