SolyxImmortal

Training users to spot phishing emails and suspicious attachments remains one of the most reliable defenses against malware that depends on user interaction to gain its initial foothold.

SolyxImmortal is a Python-based information stealer... The Python script imports 15 different modules to expand its functionality.

When the Python script is executed, the entry function calls the start function.

It copies itself into the APPDATA folder, disguises itself as a Windows graphics driver file, and sets a registry key to run every time the user logs in.

It copies itself into the APPDATA folder, disguises itself as a Windows graphics driver file, and sets a registry key to run every time the user logs in.

The Python script imports 15 different modules to expand its functionality... base64 Used to decode base64 content.

It saves itself as win_gfx_driver.exe and sets its file attributes to hidden and system... The registry key it creates, named WindowsGfxDriver, sounds like a legitimate Windows component.

It saves itself as win_gfx_driver.exe and sets its file attributes to hidden and system, making it invisible during standard file browsing.

The script starts by adding persistence by copying itself to the APPDATA folder and modifying the Run registry to execute the script from %APPDATA%\WindowsGraphics wherever the user logs in.

The keylogger runs in a separate thread and records every keystroke the user makes. Every 60 seconds, the collected keystrokes are packaged as a JSON blob and sent to the attacker.

Beyond passwords, the malware also grabs Firefox cookies by copying the browser’s cookie database directly to a staging folder.

SolyxImmortal is a Python-based information stealer that targets sensitive files, credentials from Chromium-based browsers, and keystrokes.

It pulls saved passwords from Chromium-based browsers such as Chrome, Edge, Brave, and OperaGX by reading their local databases and decrypting stored credentials using AES decryption.

Then the malware attempts to extract passwords from Chromium-based browsers. This is done by extracting decryption keys from the Local State file for each browser of interest before copying the login data file.

It iteratively walks the file system starting from the user’s home directory and excludes certain paths, such as AppData, Windows, Program Files, and Temp.

It then walks the user’s home directory looking for documents in .txt, .pdf, .docx, and .xlsx formats.

The keylogger runs in a separate thread and records every keystroke the user makes. Every 60 seconds, the collected keystrokes are packaged as a JSON blob and sent to the attacker.

The screen capture function works in two modes: routine screenshots every two minutes, and immediate screenshots triggered when a sensitive keyword appears in the title of the active window.

Files between 100 bytes and 10 MB are copied and bundled into a zip archive named Solyx_Final_Data.zip before being uploaded to Discord.

Before exfiltrating the staged data, the staging folder is compressed and saved in the TEMP folder as Solyx_Final_Data.zip.

If a file is specified, it is sent as part of the POST request; otherwise, the content is sent as a JSON blob.

Public reporting from Cyfirma indicates that the malware exfiltrates data via Discord webhooks.

The malware leverages Discord webhooks as its data exfiltration channel... Data leaves the infected machine through Discord’s own web API using Python’s requests library, blending malicious traffic with normal web activity.

Public reporting from Cyfirma indicates that the malware exfiltrates data via Discord webhooks.