Removing Typhon (Reborn) stealer-type malware from your operating system
Written by Tomas Meskauskas on (updated)
What is Typhon?
Typhon is a stealer-type malware written in the C# programming language. Newer versions of this program are called Typhon Reborn (TyphonReborn). Malware within this classification is designed to extract data from infected systems. The older variants of Typhon have a broader range of functionalities, while Typhon Reborn versions are streamlined stealers.
Typhon malware overview
Following successful infiltration, Typhon begins gathering relevant system data, e.g., hardware information (CPU, GPU, RAM, Battery status), OS version, screen resolution, machine name, username, installed anti-virus, saved Wi-Fi passwords, running processes, etc.
This malware can also take screenshots and pictures via integrated/attached cameras. Typhon can download system and user files.
This stealer is capable of extracting a wide variety of data from various applications. It targets browsing histories, downloads, bookmarks, Internet cookies, usernames/passwords, and credit card numbers stored on browsers (full list). Additionally, Typhon attempts to extract data from messengers (e.g., usernames/passwords, tokens, sessions, etc.), VPNs, gaming software, and FTPs (full list).
The malicious program also tries to steal offline (cold) cryptocurrency wallets and crypto extensions for Google Chrome and Microsoft Edge browsers (full list).
The aforementioned features are typical for both old and new versions of Typhon. As mentioned in the introduction, the Typhon Reborn variants are simplified and efficient stealers, but the older iterations have varied functionalities.
Previous variants have a sophisticated keylogging (keystroke recording) ability, which is triggered whenever the victim accesses an online banking or adult-oriented website.
They also have clipper capabilities, i.e., detecting when a cryptocurrency wallet address is copied into the clipboard (copy-paste buffer) and pasting one owned by the attackers instead - thereby rerouting an outgoing transaction. These Typhon versions can identify and replace addresses associated with the following cryptocurrencies - Bitcoin, Ethereum, Monero, Stellar, Ripple, and Bitcoin cash.
Another functionality is crypto-mining which entails abusing system resources (potentially to the point of failure or permanent hardware damage) in order to generate cryptocurrency. These variants of Typhon can operate as worms and self-spread via Discord.
To summarize, the presence of software like Typhon on devices can result in severe privacy issues, significant financial losses, and identity theft.
If you suspect that your device is infected with Typhon (or other malware) - immediately use an anti-virus to eliminate it.
| Name | Typhon malware |
| Threat Type | Trojan, password-stealing virus, banking malware, spyware. |
| Detection Names (Typhon) | Avast (Win32:Typhon-A [Pws]), Combo Cleaner (IL:Trojan.MSILZilla.5958), ESET-NOD32 (A Variant Of MSIL/TrojanDownloader.Tiny.BBH), Kaspersky (HEUR:Exploit.MSIL.UAC.gen), Microsoft (TrojanDownloader:MSIL/Lyceum.A!MTB), Full List Of Detections (VirusTotal) |
| Detection Names (Typhon Reborn) | Avast (Win32:Typhon-C [Pws]), Combo Cleaner (Trojan.GenericKD.62556465), ESET-NOD32 (A Variant Of MSIL/PSW.Agent.RXP), Kaspersky (HEUR:Trojan-Downloader.MSIL.Seraph.gen), Microsoft (PWS:MSIL/Dcstl.GD!MTB), Full List Of Detections (VirusTotal) |
| Symptoms | Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine. |
| Distribution methods | Infected email attachments, malicious online advertisements, social engineering, software 'cracks'. |
| Damage | Stolen passwords and banking information, identity theft, the victim's computer added to a botnet. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Stealer-type malware examples
We have analyzed thousands of malware samples; StrelaStealer, Medusa, Ducktail PHP stealer, CovalentStealer, and Icarus are merely some of our latest finds within the stealer category.
This software can target a wide array of information or very specific details. Furthermore, malware is often multifunctional. However, how malicious software operates is irrelevant as its presence endangers device integrity and user safety regardless. Therefore, we strongly recommend removing threats immediately upon detection.
How did Typhon infiltrate my computer?
Since Typhon's developers offer it for sale online - how it is proliferated depends on the cyber criminals using it at the time. Generally, this software is spread using phishing and social engineering tactics. Malicious programs are typically disguised as or bundled with ordinary content.
Virulent files can be Microsoft Office and PDF documents, archives (ZIP, RAR, etc.), executables (.exe, .run, etc.), JavaScript, and so forth. When a malicious file is executed, run, or otherwise opened - the infection chain is triggered.
Malware is most commonly distributed through drive-by (stealthy/deceptive) downloads, malicious attachments/links in spam emails and messages, online scams, dubious download sources (e.g., unofficial and free file-hosting websites, Peer-to-Peer sharing networks, etc.), illegal software activation tools ("cracks"), and fake updates.
How to avoid installation of malware?
We strongly recommend downloading only from official and verified channels. Additionally, it is important to activate and update software using functions/tools provided by legitimate developers, as illegal activation tools ("cracks") and third-party updaters can contain malware.
We advise against opening the attachments and links present in suspicious mail, as they can be malicious and cause system infections. It is essential to be careful when browsing since illegitimate and dangerous online content usually appears harmless.
We must stress the importance of having a dependable anti-virus installed and kept up-to-date. Security programs must be used to run regular system scans and to remove detected threats/issues. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.
Appearance of Typhon stealer being promoted on hacker forums (GIF):
List of browsers targeted by Typhon stealer:
Google Chrome, Mozilla Firefox, Microsoft Edge, Opera, QIP surf, 7Star, Iridium, CentBrowser, Chedot, Vivaldi, Kometa, ElementsBrowser, Epic privacy browser, Uran, Coowon, Citrio, Liebao (Cheetah) browser, Orbitum, Comodo, Chromodo, Amigo, Torch, 360Browser, Maxthon3, K-Melon, Sputnik, Nichrome, Atom, Brave, Waterfox, Thunderbird, IceDragon, Cyberfox, Blackhawk.
List of messaging software targeted by Typhon stealer:
- Discord
- Telegram
- Pidgin
- qTox
- Element
- Signal
- Skype
- ICQ
- Outlook
List of VPNs targeted by Typhon stealer:
- NordVPN
- OpenVPN
- ProtonVPN
List of Gaming software targeted by Typhon stealer:
- Minecraft
- Steam
- Uplay
List of FTPs targeted by Typhon stealer:
- FileZilla
- WinSCP
List of "cold" cryptocurrency wallets targeted by Typhon stealer:
Armory, AtomicWallet, Bitcoin, Bytecoin, Coinomi, Dash, Electrum, Ethereum, Exodus, Guarda, Litecoin, Zcash.
Update 8 May 2023 - The most recent iteration of the malware boasts a refactored codebase that has significantly enhanced its existing capabilities. The developer claims that the new Typhon stealer has more advanced anti-analysis and anti-virtualization capabilities. It is probable that this malware will be utilized in forthcoming attacks.
Furthermore, the developer has implemented several alterations to the logic that prevent the malware from infecting systems that meet specific predetermined criteria. This includes significantly expanding the list of criteria to include present usernames, CPUIDs, applications, and processes that are running on the system, as well as checks for debugger/emulation and geolocation data for countries that attackers may prefer to avoid.
Moreover, it seems that the developer has eliminated the feature that ensures the malware's persistence across system reboots. Instead, V2 simply terminates itself once it has completed its task of data exfiltration.
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
How to remove malware manually?
Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.
If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:
If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:
Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:
Restart your computer into Safe Mode:
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.
Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".
Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".
In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Extract the downloaded archive and run the Autoruns.exe file.
In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.
Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.
You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".
After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.
Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.
These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.
Frequently Asked Questions (FAQ)
My computer is infected with Typhon malware, should I format my storage device to get rid of it?
No, Typhon's removal does not require formatting.
What are the biggest issues that Typhon malware can cause?
The threats posed by malware depend on the program's capabilities and the cyber criminals' goals. Typhon and its newer versions (Typhon Reborn) operate as stealers - data-stealing malware that can extract sensitive data from infected devices. Hence, their infections can cause severe privacy issues, significant financial losses, and identity theft.
However, older variants also have clipper, cryptominer, and worm functionalities - which can cause seriously decreased system performance or failure, permanent data loss, and hardware damage.
What is the purpose of Typhon malware?
Typically, malware is employed to generate revenue. However, cyber criminals can also use this software to amuse themselves, carry out personal vendettas, disrupt processes (e.g., websites, services, etc.), and even launch politically/geopolitically motivated attacks.
How did Typhon malware infiltrate my computer?
Malware is primarily distributed via online scams, drive-by downloads, spam emails and messages, dubious download channels (e.g., unofficial and free file-hosting websites, P2P sharing networks, etc.), illegal program activation tools ("cracks"), and fake updates. What is more, some malicious programs can self-proliferate through local networks and removable storage devices (e.g., USB flash drives, external hard drives, etc.).
Will Combo Cleaner protect me from malware?
Yes, Combo Cleaner can detect and eliminate most of the known malware infections. It must be emphasized that since sophisticated malicious software hides deep within systems, performing a complete system scan is paramount.
Outstanding!
▼ Show Discussion