Beware of fake TradingClaw trading aids

Beware of counterfeit TradingClaw trading aids. Used to get data theft instead of getting profit from trading.

When it comes to the fake trading tool that is becoming famous right now, it can't escape the fake TradingView that comes with the famous "Somchai Sao" ad, but this time the trader is going to find a new threat from another fake trading tool.

According to a report by the official website of anti-malware developer Malwarebytes, it has mentioned the detection of a malware-stealing campaign from the victim's machine, or an Infostealer called Needle Stealer, through a fake website, tradingclaw [.] pro, which claims to provide an artificial intelligence (AI or Artificial Inteligence) trading aid called TradingClaw. On that website, it claims that this tool is an AI assistant for the famous trading tool TradingView. The behavior of the website in the display varies according to the visitor (Visitor). To the website, it will enter the TradingClaw web page directly, but some will be sent (Redirect) to the studypages [.] com website instead. The web is a technique for filtering victims, allowing malware to reach only victims in a defined group.

The files on the website that claim to be a zip compressed file format. This leads to the first step in embedding malware into the machine. With the use of a DLL Loader called iViewer.dll to load the Needle Stealer malware DLL file and shoot the malware code into a Windows process called RegAsm.exe, which can be called a fusion of the DLL Hijacking and the HOpen process.

The Needle Stealer malware has four main internal components:

Needle Core is the core of malware, which acts to steal data filled in by victims on websites, known as Grabbing and Stealing data located on ClipBoard.

The Extension Module is used to gain control of the web browser, alter traffic directions, fire scripts into the web browser, and shuffle downloaded files.

Desktop Wallet Spoofer is a tool used to attack Crypto Wallet applications on desktops such as Ledger, Trezor, and Exodus.

Browser Wallet Spoofer is used to attack wallets located on web browsers such as MetaMask and Coinbase. It also has the ability to steal wallet recovery codes or Seed Phrase.

The ability to steal information is called abundant.

Screenshot secretly recording (Screenshot)

Theft of web browser data such as website browsing history, cookie files, and saved data

Stealing data from applications such as Telegram and FTP tools

Stealing files in the .txt genus and other Crypto Wallet-related information

Steal data inside the Crypto Wallet directly.

In addition, the malware allows active hackers to release fake web browser add-ons or extensions. Using the Golang language, the script is made to unpack a fake Extension file that is created (often a file named base.zip or meta.zip). It is accompanied by a Configuration file named cfg.json. The script within this file is an important part of sending the stolen data to the control server (C2 or Command and Control). Part of the script looks like this:

{

"extension _ host": {},

"api _ key":... "

"server _ url": "https: / / C2 / api / v2,"

"Self _ destruction": true,

"base _ extension": true,

"ext _ manifest": {

"account _ extension _ type": 0,

"Active _ permissions": {

"api": [

"History,"

"notifications,"

"storage,"

"tabs,"

"WebNavigation,"

"declarativeNetRequest,"

"scripting,"

"declarativeNetRequestWithHostAccess,"

"Sidewall Panel"

],

"Explicit _ host": [

""

],

"manifest _ permissions": [],

"scriptable _ host": [

""

]

},

"commands": {

"_ execute _ action": {

"was _ assigned": true.

}

},

...

The malware places a fake Extension file in the %LOCALAPPDATA%PackagesExtensions folder with three other scripts: popup.js, content.js, and background.js.

# Trending # Lemon 8 Howtoo # lemon 8 diary # Tradingclaw # freedomhack