DNS Intelligence Detects ViperSoftX Infostealer Variant

EfficientIP’s DNS Threat Intelligence has detected a new ViperSoftX Infostealer variant linked to the previously exposed EIP-458-CryptoStealer. What began as a single-domain, stealthy zero-day has evolved into a complex, well-structured, and resilient campaign designed to evade takedowns. Attackers now reinforce their infrastructure with systematic domain clusters, selective registrations, and shared configurations, making the infostealer more persistent and dangerous. This blog shows the critical role of DNS Threat Intelligence in exposing such hidden threats.

Recap: How DNS Threat Intelligence First Exposed the EIP Infostealer

The EIP-458-CryptoStealer, later confirmed as a ViperSoftX Infostealer variant, was first detected by EfficientIP’s DNS Threat Intelligence through DNS traffic monitoring. This early detection was crucial as the zero-day malware employed advanced evasion tactics, shifting from DNS TXT manipulation to HTTPS and operating in memory with encoded data to enable stealthy data exfiltration. Traditional security measures like antivirus, EDR, and firewalls proved insufficient against such stealthy threats, underscoring the necessity of DNS Security as a critical layer of defense. Our previous blog detailed this deep research, showing how DNS Threat Intelligence uncovered the campaign and exposed its evolving tactics.

A New Variant  of the Infostealer Recently Exposed

Continuous monitoring by DNS Threat Intelligence identified a new zero-day variant of the EIP-458 Infostealer campaign by mid-2025, formally designated EIP-461-CryptoStealer v2. The variant reveals that the campaign is expanding, showing greater persistence, and evolving its tactics. Moreover, the research revealed that the Cryptostealer is, in fact, a ViperSoftX Infostealer variant.

The broadened activity demonstrates that attackers are deliberately strengthening their infrastructure to resist takedown efforts. This shift highlights a determined move toward long-term durability, persistence, and reach.

Strengthening Attack Infrastructure With Structured Clusters

In analyzing this new ViperSoftX Infostealer variant, researchers found that attackers no longer relied on isolated domains. Instead, they built structured clusters with clear naming rules, rotating them in as needed. This systematic design gave the campaign persistence, even when individual domains were blocked or taken down.

We’ll cover these techniques in depth — including how EfficientIP’s AI-driven detection exposed entire clusters before they became operational — in our next blog focused on early detection of domain-based threats.

Coordinated Infrastructure and Registration Tactics

Expanding beyond domain patterns, the campaign demonstrated a carefully coordinated approach to infrastructure and registration. While hundreds of interchangeable domains were algorithmically possible, only a select few were formally registered and made operational. 

Notably, activatordb.com was registered on March 16, 2025 and slimawriter.com on April 17, 2025, both through Njalla, a registrar known for providing anonymity services. In contrast, quasardb.com appeared legitimate — registered since 2007, tied to QUASAR DATABASE TECHNOLOGIES, hosted on Microsoft Azure, with ownership validated through TXT records.

The use of VirusTotal Graph quickly highlighted links across these domains. Several unregistered domains were already flagged as malicious by antivirus engines and associated with a specific PowerShell script (SHA256: db0bb352bd600db588e65f7bd1ee74bfad9cb11ee67f59497e2d442c6f962aa9). This script was responsible for downloading the stager from domains such as slimawriter.com, underscoring the operational role of this infrastructure.

Graph-based analysis of DNS infrastructure confirmed that these domains were not isolated artifacts but part of a linked ecosystem. Shared configurations, overlapping registration details, and synchronized activity patterns revealed deliberate planning by the attackers. By registering only the minimal number of domains needed to keep the campaign active, while leaving many others dormant or unregistered, they built an infrastructure that was both resilient and scalable.

This selective registration strategy gave attackers the ability to operate with stealth and efficiency: a few active domains maintained the campaign, while the larger pool of potential domains remained hidden until needed. Combined with the systematic naming and DGA logic, this coordination ensured the campaign could endure disruption and scale on demand.

Link to Notorious ViperSoftX Confirmed

A critical finding in the analysis is the confirmed link to the notorious ViperSoftX malware family. ViperSoftX is a long-running infostealer known for targeting credentials, cryptocurrency wallets, and browser data — and it remains active today, with ongoing campaigns observed in the wild.

ViperSoftX Activity June 2025

The present campaign shows direct overlap with this family, confirmed through cryptographic and infrastructure evidence. The strongest proof comes from cryptographic reuse. Analysis revealed that the malware employed an RSA public key (KeyBlob) to verify payload signatures — the exact same key previously identified in ViperSoftX samples. In hexadecimal form, the key is:

0602000000c2a40000525341310004000001000100c2abc28813c28bc3971fc2a9c3b2c2850bc292694f0dc28c58770002c3b94f114dc298c3a4c2a21f38755944c2b6c382c2aac3ba10034e685c252509c3bac2a4c3b4c383765cc2be3a1423c286530ac3a572c3a5c289c3b4c2b20a1f2e50c39d49c281c3b0c2b709c3b5c2b1c3844dc28f47c28e3c0575c3b136027417c3a1c291352e15c28ec29ec38ec3bac2b5c3b1086e6554c39ac39b63c384c38370475d376fc39ac3910c65c2a52d0d247661c3a8c381c3b5c39dc2b4c2a9

The reuse of this unique cryptographic signature provides high-confidence attribution, confirming that the same threat actors are behind both the current malware and ViperSoftX. Publicly available research on GitHub further corroborates this link, documenting earlier PowerShell variants of ViperSoftX using the same key.

Historical infrastructure patterns reinforce the connection. Previous ViperSoftX variants relied on a similar domain generation scheme, using prefixes like wmail, fairu, bideo, privatproxy, and ahoravideo, combined with suffixes such as endpoint, blog, chat, cdn, and schnellvpn, across .com and .xyz TLDs. 

Prefix	Suffix	TLD
wmail	endpoint	com
fairu	blog	xyz
bideo	chat
privatproxy	cdn
ahoravideo	schnellvpn

The continuity of domain-generation logic, combined with the cryptographic overlap, confirms this is not a copycat but an evolution of the same malware line. The domains observed in the current campaign belong to the same DGA family (PwrSh:CryptoStealer-C) that EfficientIP has been tracking in its DNS threat intelligence feed, DNS Threat Pulse (DTP), since June 2022. This long-term presence demonstrates that the same ViperSoftX operators have been refining and extending their campaigns for years.

This attribution significantly elevates the threat level. Attackers are not only reusing a proven infostealer family but also scaling it with systematic clusters, coordinated infrastructure, and DGA-powered persistence, transforming ViperSoftX into a more resilient and persistent campaign.

The EfficientIP DNS Security solution can detect such resilient attacks thanks to the combination of advanced DNS Filtering and a dynamic threat intelligence feed, enabling early detection of suspicious activity and blocking malware, phishing, and data exfiltration attempts.

Key IOC Summary (Domains and Hash Files Only)

Description	Type	Value
Unique Malware Detection – May 2025 – EIP-458
Active C2, registered Apr 17, 2025 via Njalla	Domain	slimawriter[.]com
Original C2 domain used to deliver stager via DNS TXT queries	Domain	activatorcounter[.]com
Stage file	Hash	Md5 : afd1c0d22c427d419da11b855a63605dSha1: 1ae9b3e0b4d8df0c045258d43521c5f89b8a7be8Sha256: e06d9924e8bb258480702d91a75bfda05f4ddf71869762e3bdfdd6f7f7554437
Payload file	Hash	Md5 : 6be0c02582a2d8da479f543dacf1691dSha1: 86675dedad33de575cf809a607ace11062f834a7Sha256: a7c268b33d953662c2208167d1c8393143707ded559c98b854d2f5c455209ceb
Unique New Variant Detection – September 2025 – EIP-461
Registered domain, Mar 16, 2025 via Njalla	Domain	activatordb[.]com
Legitimate domain (since 2007, Azure-hosted, tied to QUASAR DATABASE TECHNOLOGIES)	Domain	quasardb[.]com
PowerShell stager for in-memory execution	SHA256	db0bb352bd600db588e65f7bd1ee74bfad9cb11ee67f59497e2d442c6f962aa9
Domains Detected by DGA Tuple Clustering Detection – From June 2022 – EIP-455Also identified as Infostealer EIP-461
Systematic domain cluster – Slima prefix	Domains	slimardb[.]com, slimardb[.]xyz, slimashlow[.]com, slimashlow[.]xyz, slimatfdsc[.]com, slimatfdsc[.]xyz, slimavirtualb[.]com, slimavirtualb[.]xyz, slimawriter[.]xyz
Systematic domain cluster – Activato prefix	Domains	activatordb[.]xyz, activatoshlow[.]com, activatoshlow[.]xyz, activatotfdsc[.]com, activatotfdsc[.]xyz, activatovirtualb[.]com, activatovirtualb[.]xyz, activatowriter[.]com, activatowriter[.]xyz
Systematic domain cluster – Freed prefix	Domains	freedrdb[.]com, freedrdb[.]xyz, freedshlow[.]com, freedshlow[.]xyz, freedtfdsc[.]com, freedtfdsc[.]xyz, freedvirtualb[.]com, freedvirtualb[.]xyz, freedwriter[.]com, freedwriter[.]xyz
Systematic domain cluster – Quasar prefix	Domains	quasardb[.]xyz, quasashlow[.]com, quasashlow[.]xyz, quasatfdsc[.]com, quasatfdsc[.]xyz, quasavirtualb[.]com, quasavirtualb[.]xyz, quasawriter[.]com, quasawriter[.]xyz
Systematic domain cluster – Yeild prefix	Domains	yeildrdb[.]com, yeildrdb[.]xyz, yeildshlow[.]com, yeildshlow[.]xyz, yeildtfdsc[.]com, yeildtfdsc[.]xyz, yeildvirtualb[.]com, yeildvirtualb[.]xyz, yeildwriter[.]com, yeildwriter[.]xyz
Active C2, registered Apr 17, 2025 via Njalla	Domain	slimawriter[.]com
Original C2 domain used to deliver stager via DNS TXT queries	Domain	activatorcounter[.]com
Active C2, registered Apr 17, 2025 via Njalla	Domain	slimawriter[.]com

Recommendations

The evolution of EIP-461-CryptoStealer v2 demonstrates that modern infostealers are designed for persistence and resilience, evading traditional endpoint and perimeter defenses. To reduce exposure to stealthy malware campaigns such as the evolving EIP Infostealer, organizations must adopt proactive DNS-centric defenses:

1. Implement layered security with DNS traffic analysis
   Monitor anomalies such as TXT-only queries, unusual packet sizes, or systematic domain patterns by leveraging DNS Security. DNS is often the first and only layer to reveal malicious activity.
2. Regularly update DNS threat intelligence feeds
   Ensure resolvers are enriched with continuously updated DNS-Centric intelligence feeds capable of identifying newly generated domains and malicious clusters.
3. Enable granular DNS filtering at the resolver level
   Block malicious infrastructure in real time using granular client filtering to disrupt C2 communications, stop data exfiltration,  and prevent attackers from rotating through systematic domain clusters.
4. Integrate DNS insights into SOC and SIEM workflows
   Feed DNS IOCs into SOC playbooks and SIEM dashboards to accelerate investigation, triage, and incident response.
5. Conduct regular DNS audits and risk assessments
   Regular DNS risk assessments help organizations uncover hidden exposures and validate their defensive posture.
6. Utilize AI-driven algorithms for malware and DGA detection and analytics
   Tools such as EfficientIP’s patented DGA Tuple Clustering engine can expose malicious clusters before they become operational. The DNS Intelligence Center delivers insightful, actionable, and reliable DNS analytics to strengthen threat detection, accelerate investigations, and support forensic analysis.
   

By implementing these measures, organizations can ensure that DNS Security serves as a front-line defense — proactively detecting, blocking, and anticipating infostealer campaigns before they cause data theft, financial losses, or regulatory exposure.

Conclusion

The discovery of a new EIP-458 Infostealer variant shows how the campaign continues to expand with systematic domains and resilient infrastructure. The confirmed link to the notorious ViperSoftX family underscores the severity of this threat: attackers are not only reusing proven malware but also scaling it into stronger, more persistent campaigns. According to a Forrester study, 85% of security leaders conduct regular DNS audits to improve cloud infrastructure security. EfficientIP helps put this into practice with a free DNS Risk Assessment, enabling organizations to validate their exposure and strengthen DNS as a front-line defense.