GlassWorm Malware Revisited

The GlassWorm malware is back again. This time using the blockchain network, Solona releases RAT into stealing victim krypto.

Blockchain technology, by and large, is usually understood by the average person to be a technology that only applies to Cryptocurrency, but in fact, this technology can be applied in a variety of ways, not even to become part of the Infrastructure system of malware.

According to a report by the website, The Hacker News has mentioned the detection of a new GlassWorm malware campaign that will lead to the release of Remote Access Trojan malware on the victim machine to use malware features such as Keylogging, stealing cookies, stealing Token applications, and sending data back to hackers on external servers. There is also a feature to receive commands from the same server hard to detect. The interesting thing about this campaign is that the C2 or Command and and Control server is on the same line and a malware manager. Such an RAT hides an address on a Memo that occurs during a transaction on Solana's blockchain network. The address is converted via Resolver, which will be the IP number "45.32.150 [.] 251" of the server. In addition, the traffic uses the same channel, which is so complex that it is difficult to detect.

For the campaign itself, malware installation deception is initiated by hackers creating fake accounts or secretly stealing accounts for the use of famous digital archives such as npm, PyPI, GitHub and Open VSX to upload and release packages with malware insertion through this channel (the source does not say what package is released and what software is used to deceive downloading, but it is expected to be the use of phishing deception). In addition, to ensure that the malware is updated at any time, hackers also steal accounts for project maintenance ( Project Maintainer) has also been active for such purposes.

After the installation is completed, the initial malware will check whether the machine is in use in Russia to avoid problems with Russian authorities that could lead to a crackdown on the group (making it expected that the group behind it is likely to be Russian hackers), as well as determine which operating system the victim's machine uses? Then contact the C2 server to download payload files through the above-mentioned channels. The payload is designed to be used for data theft by means such as password theft, Crypto Wallet theft, and all system data. It is zipped compressed to an external server located at the IP number "217.69.3 [.] 152 / wall." In addition to this server, it is a server for obtaining stolen data. The last payload is found to be stored and will be sent. Downloaded from the same server to the victim's machine. The two organizations of the Payload suite are as follows:

The first payload will be a file for running in the format. NET binary is designed to steal Cryptokerrency wallet data. This payload will use Windows' Windows Management Instrumentation (WMI) to detect the use of a USB drive to plug in a hardware wallet such as Ledger or Trezor. If detected, it will show a screen for the use of the UI or User Interface of the two pockets and pretend to have a malfunction. Error must re-enter all 24 Seed Phrases for use. Purse, which if the victim believes, will immediately lead to the loss of the entire wallet. This method is called Wallet Phishing. In addition, this malware has the ability to prevent real bag management software like Ledger Live from running to compete.

The second payload is a RAT malware in the form of JavaScript. Google Calendar's event manager is used to obtain contact information with the C2 server. Distributed Hash Table (DHT) is used to handle this part. If the contact in the channel is problematic, it will automatically switch back to the C2 server via the Solana network. After the malware is embedded on the machine, the malware will install an extension called Google Docs Offline on the Chrome web browser. This add-on will serve as a contact for Get commands from the C2 server that focus on cookies, localStorage files, Document Object Model (DOM) data from the active web browser tab, Bookmark data, Keystroke, Screenshot, Clipboard data, Extension list installed, and over 5,000 web browser history. There are also many other commands available, such as

Start _ hvnc / stop _ hvnc, used to install Hidden Virtual Network Computing (HVNC) modules or hidden simulated computer networks, to be used to remotely control the victim's machine.

Start _ socks / stop _ socks, used to enable the WebRTC module to be adopted as SOCKS proxy.

REGET _ log, used for data theft from various web browsers such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox. This command can evade the encryption system on the app itself of Chrome or App-Bound Encryption (ABE).

Get _ system _ info, used to send the victim's machine system data back to the server.

Command, used to run JavaScript through the eval () channel.

# Trending # Lemon 8 Howtoo # lemon 8 diary # Solona # freedomhack