<p>As the crypto industry grows more visible and valuable, it has come to the attention of advanced threat actors.&nbsp; Recently, Halborn has identified an attack campaign against crypto groups that is believed to be performed by an APT (Advanced Persistent Threat) affiliated with China.</p><h2>Analyzing the Malware</h2><p>A recent report stated that the author “recently discovered a Remote Access Trojan (RAT) virus posted in a crypto investment public Telegram chat.&nbsp; The company says the purpose of this Trojan was to steal Bitcoin keys.”&nbsp; Based on an investigation of the malicious files attributed to this attack, Halborn has identified the malware as a Gh0stRAT variant likely associated with an unknown Chinese APT.</p><p>Gh0stRAT is a well-known RAT that provides the attacker with various capabilities, including the ability to remotely control and monitor the target computer.&nbsp; Among other features, this Gh0stRAT variant can capture keystrokes and screenshots, use the microphone and camera, and download files from the infected computer.</p><p>After being dropped and executed on the computer, this malware copies itself to the SysWoW64 directory with the name Skc2sk.exe.&nbsp; It then adds itself as a startup service to maintain persistence across reboots and deletes the original file using the command prompt.&nbsp; As part of this process, the malware also connects to a command and control (C2) server on a hosting provider commonly used by the suspected Chinese APT behind the attack.</p><p>Once running on the infected machine, the malware takes various actions, including:</p><ul><li>Attempting to run with Administrator permissions</li><li>Checking if the computer supports RDP, which would provide the attacker with remote access</li><li>Likely uses mimikatz to dump passwords from Windows as indicated by the string “GetMP privilege:debug sekurlsa::logonpasswords exit” in the malicious process; memory</li><li>Likely scans for active antivirus programs on the system from a list of associated AV names</li></ul><p>These and other capabilities indicate that the malware is a RAT.&nbsp;&nbsp;</p><p>Due to the presence of certain strings within the malware and details of the malware’s actions on an infected system, this malware is identified as a Gh0stRAT variant similar to Zerogost.&nbsp; These malware variants and the command and control infrastructure used by this malware are commonly attributed to attacks by an unknown APT affiliated with China.</p><h2>Protecting Against Malware Attacks</h2><p>This malware is used to collect various types of sensitive information; however, there is no evidence that it is specifically targeting the private keys of blockchain accounts.&nbsp; However, the malware’s ability to collect keystrokes and login credentials could lead to the compromise of these accounts.</p><p>This attack campaign used a <a href="https://halborn.com/what-is-phishing-attack-techniques-and-examples/">phishing attack</a> within Telegram channels associated with crypto investing.&nbsp; When on Telegram and other communications platforms, be cautious about downloading and opening any files.&nbsp; If you need to download a file, make sure that it is scanned by a reputable antivirus before opening it.</p>

APT-Campaign-Targeting-Crypto-Groups.jpg

Halborn uncovers attack campaign against crypto groups believed to be performed by an APT (Advanced Persistent Threat) affiliated with China.

// Blog

Alpcan Onaran

Articles