SOLYXIMMORTAL : PYTHON MALWARE ANALYSIS

MITRE Techniques

• [T1059.006 ] Command and Scripting Interpreter: Python – Malware is implemented and executed as a Python script to run the main logic (‘The malware starts running when the script is executed directly, using a standard Python entry point to trigger its main logic.’)
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys – Persistence is established by registering the copied executable under the user Run key (‘By registering itself under the user’s Run key, the malware ensures execution upon each user logon without requiring administrative privileges.’)
• [T1555.003 ] Credentials from Password Stores: Browsers – Extracts browser master key and decrypts saved logins from browser databases (‘To decrypt stored credentials, the malware extracts the browser master encryption key from the Local State file.’)
• [T1552.001 ] Unsecured Credentials: Credentials in Files – Aggregates recovered credentials in plaintext prior to exfiltration (‘Recovered credentials are aggregated in plaintext format prior to exfiltration, indicating no local encryption or obfuscation of stolen data.’)
• [T1056.001 ] Input Capture: Keylogging – Implements a persistent keyboard listener that buffers keystrokes and periodically exfiltrates batched data (‘Keystroke capture is implemented using a persistent keyboard listener.’)
• [T1113 ] Screen Capture – Continuously captures screenshots and triggers immediate captures on sensitive window-title matches, sending images via a screenshot-specific webhook (‘When a match is detected, the malware captures a screenshot and transmits it immediately via the screenshot-specific webhook.’)
• [T1083 ] File and Directory Discovery – Recursively enumerates the user’s home directory to locate documents matching extension and size filters (‘The malware recursively enumerates the user’s home directory to locate documents of interest.’)
• [T1041 ] Exfiltration Over C2 Channel – Exfiltrates staged artifacts and screenshots via HTTPS POST requests to Discord webhook endpoints (‘All data exfiltration is performed via HTTPS POST requests to Discord webhooks.’)
• [T1102.003 ] Web Service: Third-Party Services – Abuses Discord (third-party web service) for command-and-control and data exfiltration (‘All observed outbound communication occurs over HTTPS (TLS 1.3) and is directed to Discord webhook endpoints.’)
• [T1027 ] Obfuscated/Compressed Files and Information – Compresses harvested artifacts into ZIP archives to reduce transfer size and consolidate exfiltration (‘Compression serves both operational efficiency and stealth, reducing network transfer size and consolidating exfiltration into fewer outbound requests.’)