http://tweedge32j4ib2hrj57l676twj2rwedkkkbr57xcz5z73vpkolws6vid.onion/2022/evolution-of-vipersoftx-dga
The author used PowerShell to copy a persistent backdoor that would run on startup, executing the JavaScript components where the operator could run commands, download new payloads, or uninstall the malware. ViperSoftX’s main goal was to check the clipboard for cryptocurrency addresses (initially only Bitcoin and Ethereum), then replace them with attacker-controlled cryptocurrency addresses.
1 similar result skipped