TL;DR

• Valkyrie (Windows stealer): A new MaaS platform linked to Prysmax, stealing credentials and sending data to a C2 server. Detection is possible via the file path signature C:\Users\admin\AppData\Local\Temp\Valkyrie.zip and YARA rules.
• Sfuzuan (Windows backdoor): A threat distributed via multiple sources, bypassing security to gain unauthorized access and perform various malicious actions. Detection is possible via the associated TXT file dropped by the malware.
• Sorvepotel (Windows campaign): A self-propagating campaign distributed via WhatsApp messages with malicious ZIP archives. It targets Portugal and Brazil using geofencing, and employs PowerShell and VBS for persistence and propagation.

1) Valkyrie (Windows)

Sample: ANY.RUN

Valkyrie is a stealer and a new MaaS platform linked to Prysmax stealer. It steals credentials and sends data to C2.

How to detect: By the filename Valkyrie.zip in the temp directory, which contains information dumped by a stealer, including running processes and a screenshot, or by using a YARA rule.

Key facts:

• MaaS platform with explicit links in public demonstrations to Prysmax.
• Temporary storage in the Temp directory before sending data to the C2 server.

Analytical note:

Detected	External sources	ANY.RUN First Submission	Sandbox Evasion	VT First Submission
2025-10-27	News	2025-10-08	30	2025-10-28

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: filePath:"C:\\Users\\admin\\AppData\\Local\\Temp\\Valkyrie.zip"

YARA rule for searching in TI Lookup:

rule Valkyrie_Stealer {
    meta:
        description = "Detects Valkyrie information stealer malware"
        author = "ANY.RUN"
        threat = "valkyrie"
        tags = "valkyrie, stealer"

        
    strings:
        $x1 = "Valkyrie.zip" fullword wide
        $x2 = /Valkyrie \$ \d{4}/ fullword ascii
        $x3 = "C:\\ValkyrieBuilds\\" wide
        $x4 = "Valkyrie folder is empty" fullword wide

        
        $s1 = "[STEAM] Fetching URL:" fullword ascii
        $s2 = "[ZIP] Creating ZIP from:" fullword wide
        $s3 = "[ZIP] Output path:" fullword wide
        $s4 = "[-] Folder doesn't exist:" fullword wide
        $s5 = "[-] ZIP file is too small (probably empty)" fullword wide
        $s6 = "[+] Total contrase" fullword wide
        $s7 = "[OK] Screenshot guardado en: %s" fullword wide
        $s8 = "[STATS] Counted before conversion:" fullword ascii
        $s9 = "[!] Timeout alcanzado, finalizando extracci" fullword ascii
        $s10 = "[-] No se pudo obtener master key para %s" fullword ascii
        $s11 = "[!] %s - Tipo de cifrado desconocido" fullword wide
        $s12 = /\[-\] Failed to create ZIP after \d+ attempts/ fullword wide
        $s13 = "[-] No data to send!" fullword wide
        $s14 = "[SEND] Raw domain from Steam:" fullword ascii
        $s15 = /\[\*\] === DISCORD TOKEN EXTRACTION V\d+\.\d+ ===/ fullword ascii

        
        $d1 = /ABE Data Extractor v\d+\.\d+/ fullword wide
        $d2 = "Searching Registry for:" fullword ascii
        $d3 = "No supported browsers found installed on this system" fullword ascii
        $d4 = "Enumerating installed browsers..." fullword ascii
        $d5 = "Terminating browser PID=" fullword ascii
        $d6 = "Starting multi-browser extraction..." fullword ascii
        $d7 = "No supported browsers found on this system" fullword ascii
        $d8 = "Archivo copiado: %s -> %s" fullword ascii
        $d9 = "Ignorando carpeta u objeto no archivo: %s" fullword ascii
        $d10 = "Directorio tdata encontrado: %s" fullword ascii
        $d11 = "el directorio tdata." fullword ascii
        $d12 = "Wallet %s (%s) no encontrada en %s" fullword ascii
        $d13 = "Wallets encontradas:" fullword ascii

        
    condition:
        uint16(0) == 0x5A4D and 
        (
            (any of ($x*) and 8 of ($d*)) or
            (any of ($x*) and 10 of ($s*)) or
            (12 of ($s*) and 11 of ($d*)) or
            (all of ($s*)) or
            (all of ($d*)) or
            (all of ($x*))
        )
}
 

IOCs:

• SHA256: 6BA16CEBAF9782C38306051B0A2DE12056F87F12E444A581EBAFEA3783A444B7

• Domains: thenewflights.xyz

• File path: C:\Users\admin\AppData\Local\Temp\Valkyrie.zip

MITRE:

Technique ID	Technique Name	Evidence
T1204.002	User Execution: Malicious File	Saving C:\Users\admin\AppData\Local\Temp\Valkyrie.zip and subsequent unpacking/execution
T1059.001	Command and Scripting Interpreter: PowerShell	PowerShell scripts observed for downloading/decoding .NET binaries
T1055	Process Injection	Attempts to inject into processes and execute code covertly in the ANY.RUN sandbox
T1547.001	Boot or Logon Autostart Execution: Startup Folder	Auto-start via .bat/.lnk in the Startup folder for similar samples
T1567	Exfiltration Over Web Service	Sending collected data to the C2 server thenewflights[.]xyz

2) Sfuzuan (Windows)

Sample: ANY.RUN

Sfuzuan is a backdoor that can be distributed via multiple completely different sources. It compromises a device by bypassing its security systems to gain unauthorized access. This threat can perform a number of actions of a malicious actor's choice on your device.

How to detect: Detection is possible via the associated TXT file dropped by the malware.

Key facts:

• Can be distributed via multiple completely different sources from internet cafes to emails.

Analytical note:

Detected	External sources	ANY.RUN First Submission	Sandbox Evasion	VT First Submission
2025-10-30		2025-10-22	5	2025-10-30

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: filePath:"C:\\Windows\\864ac8"

IOCs:

• SHA256: 0c7b2267cbe19e61327721c52b3e8a349d7003470dad3dff07c87678d80e1564

• Domains: 31bd9b27a24e0be9.tyui54345.xyz, 31bd9b27a24e0be9.zxcv56745.xyz, down.nugong.asia, down.xy58.top, yzzcommon.tyui54345.xyz, yzzcommon.zxcv56745.xyz, 69f335c8397887d4.zxcv56745.xyz, 69f335c8397887d4.tyui54345.xyz, afdxtest.z01.azurefd.net, 02f6a0a9782b848d137c30c0502f89b6.azr.footprintdns.com, 5d77815913ef34de.tyui54345.xyz, 5d77815913ef34de.zxcv56745.xyz, xcd.yycsl.top

MITRE:

Technique ID	Technique Name	Evidence
T1569	System Services	Executes as Windows Service
T1497.003	Virtualization/Sandbox Evasion: Time Based Checks	Reads the date of Windows installation
T1012	Query Registry	Reads security settings of Internet Explorer
T1082	System Information Discovery	Reads the computer name, Checks supported languages
T1614	System Location Discovery	Checks system location settings
T1071	Application Layer Protocol	Connects to the CnC server

3) Sorvepotel (Windows)

Sample: ANY.RUN

Sorvepotel is a self-propagating malicious campaign targeting Windows systems and distributed via WhatsApp messages with malicious ZIP archives. After opening, the archive unpacks a shortcut (.LNK) that launches hidden PowerShell commands and batch scripts to download malicious components, persists in the system, and connects to the attacker's servers. If the victim has WhatsApp Web open, the malicious code uses the active session to automatically send the same archive to all contacts and groups, ensuring rapid threat propagation.

How to detect: Detection is possible via the command that creates a Windows scheduler task (which launches VBScript as SYSTEM at system startup) and the auto-start registry entry for WinManagers.vbs, which ensures that it runs at each user login.

Key facts:

• Target: Portugal/Brazil. It executes only if the user's IP address is in Portugal and the Windows system language is Portuguese.

Analytical note:

Detected	External sources	ANY.RUN First Submission	Sandbox Evasion	VT First Submission
2025-10-29	News	2025-10-08	22	2025-10-07

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: filePath:"Orcamento-2025*"

IOCs:

• SHA256 (-308d1ac9-0a6.vbs): 2c0dff7f8f724476dffd07b0f51ceaae9600073e927d3694d167664eec194b4d

• SHA256 (-e4b1d448-8e8.vbs): 341252a437e7535f9ea8707e41f0ff2a775eddb16190eeb9f0c0f524214e4f3d

• SHA256 (-d58fc83f-80f.vbs): fe10ce5fede53d88f8d06fbf533e1d9416b1c423c556915313fe52e9fa70dcec

• SHA256 (e7f_7d3a76-f4cf26cc-e7f.vbs): b05f07e5709dc25ec544ff64dabf54682f15cc2d34d2367102a096232fb3822a

• SHA256 (Orcamento para avalicaco .vbs): 536864994d1916fe45824abf0276796284c3d36c0dd98c62d5a55892623a5de0

• SHA256 (tadeu.ps1): 1fc9dc27a7a6da52b64592e3ef6f8135ef986fc829d647ee9c12f7cea8e84645

• SHA256 (Orcamento.vbs): 3ff9c9cc7cc65bef73bf75d222b8ba56728aeb4fc5e8882e82a4fab970dbe1c6

MITRE:

Technique ID	Technique Name	Evidence
T1566.001	Phishing: Spearphishing Attachment	ZIP archive with VBS spread via WhatsApp Web .
T1059.001	Command and Scripting Interpreter: PowerShell	Malicious PowerShell script executed in memory without writing to the hard drive .
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys	Creation of registry keys to run WinManagers.vbs .
T1053.005	Scheduled Task/Job: Scheduled Task	Setting up scheduled tasks for auto-start .
T1027	Obfuscated Files or Information	Obfuscated VBS and PowerShell scripts with complex masking .
T1497.001	Virtualization/Sandbox Evasion: System Checks	Checks for analysis tools and self-destructs if detected .
T1555.003	Credentials from Web Browsers	Copying Chrome profile for WhatsApp session .
T1071.001	Application Layer Protocol: Web Protocols	HTTP(S) POST/GET requests to the C2 server for management .
T1104	Multi-Stage Channels	Using IMAP/email as a backup CnC channel .
T1082	System Information Discovery	Commands to collect system and victim information (INFO) .

Conclusion

1) Attacks are shifting to private trusted channels

Sorvepotel uses WhatsApp for propagation, similar to past threats. Attackers are moving away from email and web platforms to environments with weaker filters and higher trust, increasing infection rates and making blocking more difficult.

2) Geofencing as standard anti-analysis

Triggers like IP=Portugal + language=pt-PT in Sorvepotel are now common. If sandboxes cannot simulate regional settings, some malware samples will never reveal their payloads, leading to missed detections.

3) Persistent threats remain dangerous

Sfuzuan and Valkyrie show ongoing activity with new distributions and links to existing platforms like Prysmax, providing a strong return on investment for attackers.

4) Diverse distribution vectors

Sfuzuan highlights use of multiple sources like internet cafes and emails, while Sorvepotel leverages self-propagation via messaging apps, complicating defense strategies.

5) Evasion and persistence techniques

Valkyrie and Sorvepotel employ process injection, obfuscation, and autostart mechanisms to evade detection and maintain presence, emphasizing the need for advanced telemetry monitoring.