Dispersed malware was found through a USB drive aimed at stealing Krypto money.

Dispersed malware detected through a USB drive aimed at stealing the victim's krypto money.

According to a report by the website Bleeping Computer, the detection of a new Worm malware with the ability to spread itself is insidious. This anonymous malware is a synergy between the files on the USB drive and the TOR network. A research team from Microsoft has indicated that malware addiction begins when the victim clicks an LNK file, an Internet Shortcut file that is used as a decoy, which triggers a malware file (payload) inside another file on the infected USB drive, and ultimately leads to a PowrerShell script running to contact. The C2 or Command and Control server on the TOR network, which has a domain name that ends in .ONION, downloads the last payload of the worm. After the worm is complete, the worm will start spreading itself by scanning documents (Documents) on local drives and replacing them with malware LNK files in preparation. The worm will then set the task schedule to monitor the new USB drive that will be plugged in in the future to spread on the new USB drive.

In the Task Schedule, in addition to scheduling for the above reasons, it is also timed to download malware of the type that steals data from the victim's machine, or Infostealer in malware that steals data from Clipboard, also known as Clipper Malware that focuses on stealing data related to the Cryptocurrency wallet. In the installation part, a Payload file called ugate.exe is downloaded from the C2 server for installation. In the malware operation, the malware checks data on Clipboard every half second for the following information to steal or shuffle. Information

Seed Phrases 12-Word Standard BIP39

Seed Phrases 24-Word Standard BIP39

Private Keys of Ethereum Coins

WIF keys of Bitcoin coins

Wallet address, legacy Bitcoin, P2SH, Bech32, and Taproot

Tron wallet address

Monero wallet address

In addition to stealing (in case of keys) or shuffling data (in case of wallet address) above, the malware also secretly logs 5 Screenshots per 10 seconds and then manages to secretly send Exfiltration to hackers on the C2 server through the Curl tool. In addition, the research team also found that the malware has the ability to run RCE or Remote Code Execution by downloading JavaScript scripts from the C2 server down on a cfile name and running them on the victim's machine after receiving an EVAL Instruction command. Server

# Trending # lemon 8 diary # Krypto # USB # freedomhack