Microsoft warns. Beware of "CryptoBandits" malware.

Microsoft warns. Beware of malware. "CryptoBandits" can suck pocket-shaven krypto money.

According to a report by the MEXC website, Microsoft has alerted users and investors in the Cryptokerrency coin to investigate a Crypto Clipper malware called "CryptoBandits," or Trojan: Win32 / CryptoBandits.A, which has the ability to change the address of the Cryptokerrency bag on Clipboard, causing the victim to transfer the wrong money to the hacker's pocket until the money is unknowingly lost. In addition to this ability, the malware also has the ability to smuggle data to recover wallets like Seed Phrases and private keys detected on Clipboard. The malware will scan for the data. For example, every 500 milliseconds, the likelihood of a malware missing important data is minimal. The data aimed by the malware is as follows:

Seed Phrase Standard BIP39 12-Word and 24-Word Length

Private Key of bitcoin and Etherium Coins

Alter the address of the Krypto wallet of the bitcoin coins (Legacy, P2SH, SegWit, and Taproot), Etherium, Tron, and Monero coins on the Clipboard to hackers.

There are also many other abilities, such as

Screenshot secretly recording (Screenshot)

The theft of the victim's data secretly exported from the machine (Exfiltration) through the TOR network.

Use the Command EVAL command to execute RCE or Remote Code Execution. Convert the malware into Backdoor malware to release Ransomware.

This malware spreads through a USB drive in the LNK genus Internet Shortcut file format. After plugging the infected driver into the machine, the malware hides Word, Excel, and PDF files and creates a Shortcut file of the same name instead. After the victim clicks on the fake file, the machine will be infected with the malware and spread down the other USB drives that plug in the machine. And to remove any contact with the external network, contact with the control server (C2 or Command and Control) will also act through the entire TOR network. Not only, the malware also uses the method. Task Scheduling is set to guarantee that the malware can run on the machine at any time.

# Trending # lemon 8 diary # microsoft # freedomhack # Malware