Typhon Reborn V2: Updated stealer features enhanced anti-analysis and evasion capabilities

MITRE Techniques

• [T1497] Virtualization/Sandbox Evasion – Anti-analysis and anti-VM routines, including checks for virtualization, hostings, and debuggers to avoid analysis. Quote: ‘The latest version has significantly more anti-analysis and anti-virtualization capabilities…’
• [T1057] Process Discovery – The malware enumerates currently running processes and checks for analysis tools. Quote: ‘The malware then obtains the list of currently running processes on the system and checks the executable path … against the following list of executable file names associated with common analysis tools.’
• [T1562] Impair Defenses – Checks for security-product DLLs (e.g., Sandboxie, Avast, Comodo) to evade protections. Quote: ‘the presence of the following DLLs associated with common security products that may be installed.’
• [T1012] Query Registry – Scans the Windows Registry for keys referencing analysis tools. Quote: ‘The malware also checks the Windows Registry … to determine if any subkeys reference the following common analysis tools:’
• [T1047] Windows Management Instrumentation – Uses WMI to collect system information (GPU, CPUID, computer system details). Quote: ‘The malware uses Windows Management Instrumentation (WMI) to retrieve information about the Graphics Processing Unit (GPU) on the system.’
• [T1518] Software Discovery – Enumerates installed software on the system. Quote: ‘A list of installed software is also generated using WMI and saved …’
• [T1083] File and Directory Discovery – Enumerates drives and target directories to copy data. Quote: ‘Drive enumeration. Each drive that meets this criterion has its root directory added to a list of target directories.’
• [T1113] Screen Capture – Captures screenshots of the infected system for exfiltration. Quote: ‘The malware also captures screenshots from infected systems saved in the same directory as the stealer logs.’
• [T1555] Credentials in Files – Attempts to collect saved passwords/tokens from applications and files (e.g., Wi-Fi credentials stored in Wifi Passwords.txt). Quote: ‘The stealer also collects saved Wi-Fi network information and stores it …’
• [T1041] Exfiltration Over C2 Channel – Data is compressed and exfiltrated via Telegram; overview and data messages are sent. Quote: ‘the data is stored in a compressed archive and exfiltrated via HTTPS using the Telegram API’ and ‘The malware then sends another Telegram message containing the data being exfiltrated…’
• [T1070] Indicator Removal on Host – SelfRemove functionality to delete traces after exfiltration. Quote: ‘SelfRemove.Remove() to terminate execution.’
• [T1027] Obfuscated/Compressed Files and Information – String obfuscation using Base64 and XOR to hide strings and logic. Quote: ‘The malware decodes the Base64, generating a UTF-8 character-encoded string … deobfuscated using an XOR key …’