USB worm spreads crypto-stealing malware via Windows shortcut files

Attackers concentrating on cryptocurrency wallets are distributing self-propagating clipboard-stealing malware and utilizing the Tor community to cover their communications.

The marketing campaign has been lively since no less than February and leverages LNK (shortcut) recordsdata on USB drives to push clipper malware that screens clipboard contents and replaces crypto pockets addresses with addresses managed by the attacker.

Moreover, you may monitor seed phrases and personal keys, and seize leaked screenshots through Tor.

An infection and nematode copy

In response to Microsoft, the an infection course of begins when the sufferer opens the LNK file, which triggers the malware on the USB drive. Further payloads are staged from the .ONION deal with.

An area scan searches for doc recordsdata in your system. When such a file is discovered, the malware hides the unique file and replaces it with a malicious shortcut with the identical identify. This causes the malware to run when the person makes an attempt to open the doc.

The worm creates a scheduled activity that screens newly related USB storage units. When a detachable drive is related, the malware copies itself to the gadget and creates extra malicious shortcut recordsdata.

information thief

The stealer element inside the malware runs after making certain that the duty supervisor is inactive and makes use of a Tor executable (ugate.exe) to ascertain communication with the command and management (C2) host.

The malware checks the clipboard each 0.5 seconds for the next information:

• 12 phrase BIP39 seed phrase
• 24 phrase BIP39 seed phrase
• ethereum personal key
• Bitcoin WIF Key
• Bitcoin Legacy, P2SH, Bech32, and Taproot pockets addresses
• Tron pockets deal with
• Monero pockets deal with

Goal addresses are chosen primarily based on beginning numbers or letters that partially resemble the attacker’s pockets deal with, decreasing the chance that customers will spot fraudulent exercise at first look.

Other than monitoring the clipboard, the malware additionally captures 5 screenshots of the sufferer’s display each 10 seconds and sends them to the C2 utilizing the next command: curl software.

In response to Microsoft, distant code execution, which could be triggered by the C2 EVAL instruction, can be supported. Particularly, the malware downloads JavaScript content material right into a file named “cfile” and executes it on the contaminated machine.

Researchers say the strongest indicator of an infection is behavioral, moderately than signature-based, and suggest monitoring course of exercise. wscript.exe and cscript.exesudden launch curlPowerShell, and cmd.exetogether with the irregular youngster course of.

Moreover, connections to “localhost:9050” and Tor proxy exercise are crimson flags related to this marketing campaign.