Typhon Reborn V2 Stealer Adds Anti-Analysis and Evasion Capabilities
Summary
Cisco Talos analyzes Typhon Reborn V2, an information stealer with expanded sandbox and VM evasion, broad data collection, and Telegram-based exfiltration. Samples were observed in the wild, and multiple purchases suggest future use in attacks.
Key points
- V2 adds checks for analysis tools, debuggers, virtual machines, geolocation, usernames, and system characteristics; it terminates if checks indicate an analysis environment.
- The malware obfuscates strings using Base64 and XOR, with keys stored in its configuration or hard-coded.
- It can collect credentials and other sensitive application data, cryptocurrency wallet information, screenshots, Wi-Fi passwords, system details, and configured file types.
- Collected data is compressed and exfiltrated through the Telegram API; the archive is deleted and the malware terminates afterward.
- Talos observed samples in the wild and multiple purchases of the malware, which was offered for $59 per month or $540 for lifetime access.
- V2 samples analyzed by Talos appeared to remove persistence across reboots.
Article Details
- Attack Vectors
- Typhon Reborn V2 infects systems and steals sensitive information from supported applications, including passwords, tokens, and cryptocurrency wallet data.
- The malware collects system and network information, captures screenshots, retrieves saved Wi-Fi credentials, and copies configured file types from drives.
- Collected data is compressed and exfiltrated over HTTPS through the Telegram API.
- Defensive Notes
- Use endpoint and network security controls to detect or block the malware and malicious communications; the article cites Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, Cisco Duo, and Snort rules.
- The article lists applicable Snort SIDs 61532-61533 and 300476 and notes that Cisco Secure Endpoint users can run Orbital queries to check for infection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]ipify[.]org | Typhon Reborn V2 contacts this service to obtain the infected system's public IP; the article does not identify it as attacker-controlled or malicious infrastructure. |
| URL | hxxp[:]//ip-api[.]com/line/?fields=hosting | Typhon Reborn V2 requests this IP-API URL to check whether the victim system is in a hosting, colocation, or data-center environment. |
MITRE ATT&CK
T1074 · Data StagedThe malware stages collected logs and files in a randomly named subdirectory under %LOCALAPPDATA% before exfiltration.T1082 · System Information DiscoveryThe malware gathers system information through WMI, environment variables, and registry keys.T1113 · Screen CaptureThe malware captures screenshots from infected systems.T1140 · Deobfuscate/Decode Files or InformationThe malware decodes Base64-encoded strings and applies XOR deobfuscation during execution.T1497 · Virtualization/Sandbox EvasionThe malware checks for virtualization and analysis environments, including hypervisor indicators, debugger activity, analysis tools, and sandbox-related conditions.T1555 · Credentials from Password StoresThe stealer collects passwords and other sensitive information from supported applications and retrieves saved Wi-Fi credentials.T1560 · Archive Collected DataThe collected data is stored in a compressed archive before exfiltration.T1567 · Exfiltration Over Web ServiceThe malware exfiltrates stolen data over HTTPS using the Telegram API.
People
Malware
Vendors
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.Firewall Management CenterAdditional protections with context to your specific environment and threat data are available from the Firewall Management Center.Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Orbital Advanced SearchCisco Secure Endpoint users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are infected with this specific threat. For specific OSqueries on this threat, click here.SecureXSecureXSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Tools
AutorunsAutorunsautorunsc.exeautorunsc.exede4dot.exede4dot.exeDetect It Easydetect it easydiediednSpydnSpydumpcap.exedumpcap.exefiddler.exefiddler.exeFileInsightFileInsightfilemon.exefilemon.exeGhidraGhidraHashCalcHashCalchookexplorer.exehookexplorer.exehxdhxdIDAidaidaq.exeidaq.exeidaq64.exeidaq64.exeilspy.exeilspy.exeimmunitydebugger.exeimmunitydebugger.exelordpe.exelordpe.exeollydbg.exeollydbg.exePDFStreamDumperPDFStreamDumperpetools.exepetools.exeProcess HackerProcess HackerProcess MonitorProcess Monitorprocmon.exeprocmon.exeregmon.exeregmon.exeresourcehacker.exeresourcehacker.exescyllascyllatcpview.exetcpview.exeTelegram APIThe stealer can harvest and exfiltrate sensitive information and uses the Telegram API to send stolen data to attackers.winhexwinhexWiresharkWiresharkWMIAnti-analysis process flow.The malware uses Windows Management Instrumentation (WMI) to retrieve information about the Graphics Processing Unit (GPU) on the system.x32dbg.exex32dbg.exex64dbgx64dbgx86dbgx86dbg