MalwarePublished 6 Oct 2025Updated 5 Nov 2025

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users

Source AlienVault OTX General

Description

SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers. Once opened, the malware automatically propagates via WhatsApp Web, causing infected accounts to be banned due to excessive spam activity.

Impact

For European organizations, the primary impact of SORVEPOTEL lies in the disruption of business communications via WhatsApp Web, which is widely used for internal and external communications in many enterprises. Infected accounts being banned can cause operational interruptions and reputational damage. The malware's ability to propagate through social engineering and abuse of legitimate platforms increases the risk of lateral spread within organizations, potentially leading to broader compromise. Enterprises with business relations or communication channels involving Brazilian partners or customers may face higher exposure. Additionally, the use of PowerShell and loader techniques can facilitate further payload delivery or data exfiltration if combined with other malware components. The phishing vector also poses risks of credential theft or further infection. Although the malware currently targets Brazilian users, European organizations with WhatsApp Web usage should consider the threat relevant due to the global nature of the platform and potential for adaptation by threat actors. The medium severity reflects moderate impact with limited scope but notable operational disruption and propagation risk.

Defensive guidance

1. Implement advanced email filtering to detect and block phishing emails containing malicious ZIP attachments, focusing on indicators such as suspicious sender domains and attachment anomalies. 2. Conduct targeted user awareness training emphasizing the risks of opening unexpected attachments, especially on desktop environments, and recognizing phishing attempts. 3. Restrict or monitor the use of WhatsApp Web within enterprise environments, including the use of endpoint security solutions to detect abnormal WhatsApp Web activity or automated messaging. 4. Deploy application control policies to prevent unauthorized execution of PowerShell scripts or suspicious loader binaries, using whitelisting where feasible. 5. Enable logging and monitoring of PowerShell usage and command-line activities to detect potential abuse indicative of malware execution. 6. Regularly update endpoint detection and response (EDR) tools to identify behaviors associated with SORVEPOTEL, such as persistence mechanisms and lateral propagation attempts. 7. Encourage multi-factor authentication (MFA) on WhatsApp accounts to reduce the risk of account takeover. 8. Collaborate with communication platform providers to understand and mitigate abuse vectors related to automated messaging. 9. Maintain incident response plans that include procedures for handling compromised communication accounts and rapid containment of malware spread. 10. For organizations with Brazilian connections, increase vigilance and threat intelligence sharing to detect early signs of infection.

Indicators of compromise

Domains 10

adoblesecuryt.com
bravexolutions.com
casadecampoamazonas.com
expansivebot.com
expansiveuser.com
imobiliariaricardoparanhos.com
saogeraldoshoping.com
sorvetenopote.com
www.expansiveuser.com
www.sorvetenopote.com

URLs 1

https://sorvetenopote.com/api/itbi/Q77xivT4udoXayYELTwehMD666ovP6DZ

IP addresses 4

109.176.30.141CC=GB ASN=AS206509 kcom group limited
165.154.254.44CC=SG ASN=AS142002 scloud pte ltd
23.227.203.148CC=US ASN=AS29802 hivelocity inc.
77.111.101.169CC=HU ASN=AS197248 dravanet co ltd.

Hashes 21

19230d53a96d4facbead047f645e02b8
211bab3c481245005fbad0ea8bc6dd77MD5 of c50b6ff360e5614d91f80a5e2d616a9d0d1a9984751bf251f065426a63dac0b5
553ae7e68bcaeb0354a4068330cf105bMD5 of bd62148637152396b757c8b106d5a62982bce9df12f0a6030dda9138e44e7328
5db5aef3f0e7f9a540f27b1bf8590096MD5 of 2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6
61051166b22c6388695edf8554a72cd2MD5 of 3b68826e4a1d95b1dd58b3bf1095750f31a72d8bddd1dbb35e6547ac0cf4769b
9d34bd7fa0327ebc40fa4b33897aaca0MD5 of dcdde53c50aef9531c9f59f341a4e2d59796cdd94a973f2c2a464b2cafed41f5
f8258c7b97f88428d31f567a6e12656cMD5 of 1a0af26749f5bc21732c53fc12f3a148215c8221cbeffe920411656f1ffe7500
1f6cd7c09480caf82231e4a1d9fb7593f17746b6SHA1 of 2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6
b2ca2326114f8845ef9e69efa91511d22a46e174SHA1 of 1a0af26749f5bc21732c53fc12f3a148215c8221cbeffe920411656f1ffe7500
c18af1ad244a775142e8d79e516734dec446eed4SHA1 of 3b68826e4a1d95b1dd58b3bf1095750f31a72d8bddd1dbb35e6547ac0cf4769b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Oct 2025, 19:04 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details