9 minhigh
Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI
Varonis Threat Labs analyzed Dolphin X, a multi-functional RAT and infostealer advertised by the alias 'Kontraktnik' that targets 300+ applications including browsers, cryptocurrency wallets, SSH keys, cloud CLI tokens, and DevOps credentials. The malware features a server-side build system with a three-tier mutation engine for evasion, and an AI Profiler that scores victims to help operators prioritize high-value targets. Its broad collection scope and AI-driven victim triage represent a notable evolution in cybercrime tooling.
Sens:▲ 24hConf:medium
Showing defanged values
- domainbackend[.]thedolphinx[.]topRemote build, licensing, and telemetry server for the Dolphin X operator panel; agent configurations are submitted here for server-side compilation
- domainthedolphinx[.]topParent domain for the Dolphin X vendor backend infrastructure
- sha256726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0SHA-256 hash of the Dolphin X operator panel client executable analyzed in the lab
Detection / Hunteropenrouter
What Happened
Security researchers discovered a new malware tool called Dolphin X that steals passwords, cryptocurrency wallets, and sensitive developer credentials from over 300 different applications. What makes it stand out is an artificial intelligence feature that automatically ranks infected victims by how valuable they appear, helping criminals decide who to target first. The malware is built remotely on the seller's server, making each copy slightly different to avoid detection by antivirus software. Anyone using a Windows computer — especially software developers who store cloud access keys or passwords on their machines — could be at risk. Organizations should avoid storing long-lived passwords and access keys on local machines, and security teams should focus on detecting suspicious behavior rather than relying solely on known malware signatures.
Key Takeaways
- Dolphin X is a multi-functional RAT/stealer advertised by vendor 'Kontraktnik' targeting 300+ applications including browsers, crypto wallets, SSH keys, cloud CLI tokens, and .env files.
- Features a remote build system where binaries are compiled server-side at backend.thedolphinx[.]top:8443, with an optional three-tier mutation engine to evade hash-based and YARA detections.
- An 'AI Profiler' feature scores infected victims based on app usage, browsing activity, and installed software, providing operators a daily ranked summary to prioritize high-value targets.
- Collection scope spans 9 browsers, 100+ wallet extensions, 65 desktop wallets, 10 password managers, and 30+ cloud CLI tools — a single infection on a developer machine could expose production environment access.
- Evasion capabilities include AMSI/ETW patching, direct syscalls, DLL sideloading via version.dll, UAC bypasses, and HVNC functionality.
Affected Systems
- Windows desktops and laptops
- Developer workstations with SSH keys, .env files, and cloud CLI credentials
- Systems running Chromium and Gecko-based browsers
- Systems with cryptocurrency wallet extensions or desktop wallets installed
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Malware delivered to victim (delivery vector not specified in analysis; operator panel analyzed in lab)
- Execution: Agent binary compiled server-side at backend.thedolphinx[.]top:8443 with operator-configured C2 address, installation path, persistence, and evasion options
- Persistence: Registry Run Keys, Windows Startup folder, or scheduled tasks established on infected host
- Defense Evasion: AMSI/ETW patching, direct syscalls, DLL sideloading via version.dll, three-tier binary mutation engine, and UAC bypasses applied
- Collection: Credentials and sensitive data harvested from 300+ targets including browsers (DPAPI decryption), crypto wallets (PBKDF2/DPAPI), SSH keys, .env files, and 30+ cloud CLI tools; data staged into a single archive
- Command and Control: SOCKS5 reverse proxy and HVNC functionality for remote access; AI Profiler sends daily victim risk scores and summaries to operator panel
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules but recommends behavioral detection approaches such as monitoring for explorer.exe running under a non-default desktop as an indicator of HVNC sessions.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The malware uses direct syscalls to bypass user-mode API hooks and patches AMSI/ETW, which may reduce EDR telemetry. However, process injection into browsers/wallets, DLL sideloading of version.dll, and persistence mechanisms (Run Keys, scheduled tasks) should still generate EDR events depending on vendor coverage. |
| Network Visibility | Medium | C2 communication to backend.thedolphinx.top:8443 over TLS is detectable via DNS resolution and TLS connections. SOCKS5 reverse proxy traffic may also be observable, but the article does not provide full network IOC details beyond the backend domain. |
| Detection Difficulty | Hard | The three-tier mutation engine changes binary hashes, import tables, PE timestamps, Rich headers, and control flow between builds, making signature-based detection unreliable. AMSI/ETW patching and direct syscalls further reduce telemetry. Behavioral detection is possible but requires robust EDR coverage and tuning. |
Required Log Sources
- DNS resolution logs
- TLS/SSL proxy logs
- Windows Event Logs (Sysmon Event ID 1, 3, 7, 11, 12, 13, 22)
- EDR process telemetry
- File system audit logs for .env and SSH key access
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for explorer.exe processes running under non-default desktop sessions, which may indicate HVNC activity as described in the article. | EDR process telemetry with session/desktop context, Sysmon Event ID 1 with command line and session information | Execution / C2 | Medium — legitimate remote desktop tools or multi-session environments may trigger this behavior. |
| Consider hunting for DNS resolutions to thedolphinx.top or its subdomains, which would indicate communication with the Dolphin X build or C2 infrastructure. | DNS logs, passive DNS, network proxy logs | C2 | Low — this domain is specifically associated with the malware vendor infrastructure. |
| Consider hunting for processes loading version.dll from non-standard paths, which may indicate DLL sideloading as described in the Dolphin X evasion capabilities. | Sysmon Event ID 7 (Image Loaded), EDR module load events | Defense Evasion | Medium — legitimate applications may load version.dll from application directories; context of the loading process and path is important. |
| Consider hunting for bulk file access patterns targeting .env files, SSH key directories, and browser credential stores within a short time window, which may indicate infostealer collection activity. | File system audit logs, EDR file access events, Sysmon Event ID 11 | Collection | Low to Medium — development tools may access .env files legitimately, but rapid sequential access across multiple credential stores is anomalous. |
| Consider hunting for processes attempting to patch AMSI or ETW providers in memory, which the article describes as a defense evasion capability of Dolphin X. | EDR memory protection events, Sysmon Event ID 8 (CreateRemoteThread) or Event ID 10 (ProcessAccess) targeting AMSI-related memory regions | Defense Evasion | Low — AMSI patching is almost exclusively associated with malicious activity. |
Control Gaps
- Signature-based AV and hash-based blocklists would fail against mutated builds with altered hashes, import tables, and PE timestamps.
- AMSI/ETW patching may blind runtime analysis tools that rely on these telemetry sources.
- Direct syscalls bypass user-mode API hooks used by some EDR solutions.
- DLL sideloading via legitimate-looking version.dll may bypass application control whitelisting if the parent application is trusted.
Key Behavioral Indicators
- explorer.exe running under a non-default desktop session (HVNC indicator)
- Bulk sequential file reads across browser credential stores, .env files, SSH directories, and cloud CLI config paths
- version.dll loaded from non-standard application directories
- Processes attempting to modify AMSI.dll or ETW provider memory regions
- Scheduled task creation or Run Key modification by unexpected processes
- DNS resolution to thedolphinx.top or backend.thedolphinx.top
- Process injection into browser or cryptocurrency wallet processes
False Positive Assessment
Low — the IOCs (thedolphinx.top domain, specific SHA-256 hash) are highly specific to this malware family. Behavioral indicators such as HVNC detection and AMSI patching carry low false positive rates, though DLL sideloading detection for version.dll may require additional context to reduce noise from legitimate applications.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking DNS resolution and network traffic to thedolphinx.top and backend.thedolphinx.top at your DNS sinkhole, firewall, or proxy if supported by your infrastructure.
- Consider hunting your environment for the SHA-256 hash 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0 and any DNS lookups to thedolphinx.top domains.
- If your EDR supports it, consider searching for processes loading version.dll from non-standard paths or exhibiting bulk credential file access patterns.
Infrastructure Hardening
- Evaluate whether long-lived credentials (SSH keys, cloud CLI tokens, .env files) can be replaced with short-lived, federated, or vault-based alternatives to reduce exposure if a workstation is compromised.
- Consider implementing DNS filtering or sinkholing for known malware infrastructure domains.
- Where supported by your tooling, consider enabling enhanced logging for file access to sensitive credential paths such as ~/.ssh/, .env files, and browser profile directories.
- Evaluate whether application control or DLL loading policies can restrict version.dll loading to verified Microsoft-signed paths only.
User Protection
- Consider deploying or verifying EDR coverage that includes behavioral detection for process injection, AMSI patching, and HVNC activity.
- If applicable, evaluate whether browser extensions for cryptocurrency wallets can be restricted on corporate-managed machines where they are not needed.
- Consider reviewing whether developer workstations store cloud CLI credentials locally and evaluate migrating to ephemeral, role-based access where feasible.
Security Awareness
- Consider incorporating guidance into existing awareness programs about the risks of storing credentials in local files (.env, SSH keys) and the importance of using credential managers.
- If your organization uses password managers, consider reminding employees to avoid saving credentials in browser password stores that infostealers commonly target.
- Consider educating development teams specifically about the risk of infostealers on developer machines that may contain production-accessible credentials.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping13 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Other:
backend.thedolphinx.top:8443- Host and port for the Dolphin X licensing, telemetry, and remote-build service
