Analysis of ViperSoftX and Its Expanding Threat Landscape
ASEC has identified cases where ViperSoftX distributors are installing an additional payload: Monero coin-mining malware. ViperSoftX is a remote-control malware that includes functionality for stealing cryptocurrency wallet addresses and it has typically been spread through files disguised as cracked software, keygens, or eBooks. During these attacks, the operators also deploy additional malwares such as QuasarRAT, PureRAT (PureHVNC), and ClipBanker to gain remote access and hijack wallet transactions. Recent activity shows that a coin miner is also being installed alongside these payloads. This report ViperSoftX’s attack flow, how it is evolving, and recommended mitigations.
ViperSoftX was first reported in 2020 and has since spread globally, with numerous infections observed in South Korea. Its capabilities have grown steadily, ranging from wallet-address theft and clipboard manipulation to additional payload installation and the abuse of password managers and browser extensions. In 2024, a related module called TesseractStealer emerged, leveraging the deep-learning OCR engine Tesseract to extract passwords and wallet addresses directly from on-screen images. In 2025, attacks combining ViperSoftX with new malware such as PureRAT and ClipBanker continued to appear, showing how ViperSoft-related threats are diversifying and advancing.
Malware Analysis
1. Initial Script
ViperSoftX registers a task in the Task Scheduler and periodically executes a malicious PowerShell script. Depending on the variant, the script is read and decrypted from a specific offset within the disguised host file or is loaded from the registry. This technique remains consistent throughout recent campaigns. Communication patterns remain similar to earlier activities, such as generating C&C domains through a Domain Generation Algorithm (DGA) or retrieving data using DNS TXT records.
Figure 1. DGA-based method used to obtain the C&C server
Figure 2. Downloaded encrypted PowerShell command
Two types of PowerShell commands have been identified across incidents, both used to download and install ViperSoftX or additional payloads.
Figure 3. Downloader script used to fetch additional payloads
2. ViperSoftX
ViperSoftX maintains the same core structure documented in previous analyses. It supports remote command execution, payload installation, monitoring of cryptocurrency wallet applications, clipboard hijacking for wallet addresses, and exfiltration of system information.
|
Command |
Function |
|
Cmd |
Execute PowerShell Command |
|
DwnlExe |
Download and Execute File |
|
SelfRemove |
Terminate |
|
RestartClient |
Terminate |
Table 1. Commands supported by ViperSoftX
ViperSoftX also uses an additional script that checks for installed wallet software, browser extensions, and password managers such as KeePass and 1Password.
Figure 4. Routine monitoring of wallet software and password managers
3. QuasarRAT
QuasarRAT is an open-source RAT written in .NET that provides file and process control, system task execution, remote command execution, and file transfer. It can also steal user information through features such as keylogging and credential harvesting.
Figure 5. Decrypted configuration data of QuasarRAT
4. PureRAT and PureLogs Downloader
While earlier campaigns relied mainly on QuasarRAT, attacks observed in 2025 show frequent use of PureRAT. PureRAT supports remote operations involving files, tasks, processes, and the registry, and offers additional capabilities such as HVNC, remote desktop access, keylogging, and clipboard hijacking through a plugin-based structure.
Figure 6. PureRAT configuration details
PureRAT is developed and sold by a developer known as PureCoder, who also distributes PureCrypter and PureLogs. Several samples from this campaign appear to be designed to download PureLogs, although communication with the C&C server was unavailable at the time of the analysis.
Figure 7. Downloader Configuration details
5. Coin Miner
Some downloader variants used in the attack chain appear capable of both payload delivery and coin-mining activity. Although the miner component could not be executed properly during analysis, its internal configuration contained XMRig-related parameters, indicating that it functions as a coin miner.
Figure 8. Coin-miner configuration data
Conclusion
The operators behind ViperSoftX have consistently targeted cryptocurrency users worldwide for years and continue to distribute multiple malwares as part of their campaigns. Once a system is infected, the threat actors can deploy further payloads, steal sensitive information, and perform remote operations. Recent evidence shows the installation of a coin miner, enabling the attackers to profit from victims’ system resources.
Users should avoid downloading software from suspicious websites or file-sharing platforms and ensure their operating system and applications are fully patched. Keeping AhnLab V3 up to date is also essential to block known malware and attack attempts in advance and to strengthen protection against ViperSoftX and related cryptocurrency-focused threats.
