A new evasive crypto wallet stealer named BHUNT has been spotted in the wild with the goal of financial gain, adding to a list of digital currency stealing malware such as CryptBot, Redline Stealer, and WeSteal.
“BHUNT is a modular stealer written in .NET, capable of exfiltrating wallet (Exodus, Electrum, Atomic, Jaxx, Ethereum, Bitcoin, Litecoin wallets) contents, passwords stored in the browser, and passphrases captured from the clipboard,” Bitdefender researchers said in a technical report on Wednesday.
New Micromax IN Note 2 Launching On 25th Jan 2022
Follow us on Twitter, Telegram and Instagram
The campaign, distributed globally across Australia, Egypt, Germany, India, Indonesia, Japan, Malaysia, Norway, Singapore, South Africa, Spain, and the U.S., is suspected to be delivered to compromised systems via cracked software installers.
The modus operandi of using cracks as an infection source for initial access mirrors similar cybercrime campaigns that have leveraged tools such as KMSPico as a conduit for deploying malware. “Most infected users also had some form of crack for Windows (KMS) on their systems,” the researchers noted.
The attack sequence starts with the execution of an initial dropper, which proceeds to write heavily-encrypted interim binaries that are then used to launch the main component of the stealer — a .NET malware that incorporates different modules to facilitate its malicious activities, the results of which are exfiltrated to a remote server —
- blackjack – steal wallet file contents
- chaos-crew – download additional payloads
- golden7 – siphon cookies from Firefox and Chrome as well as passwords from clipboard
- Sweet_Bonanza – steal stored passwords from browsers such as Internet Explorer, Firefox, Chrome, Opera, and Safari, and
- mrpropper – clean up traces
The information theft could also have a privacy impact in that the passwords and account tokens stolen from the browser cache could be abused to commit fraud and to gain other financial benefits.
The emergence of BHUNT is another sign that info stealers, clippers, cryptojackers, and trojans are increasingly powering cryptocurrency-focused crime, with Cryptbot raking in almost half a million dollars in pilfered Bitcoin in 2021, according to a new report from Chainalysis.
“The most effective way to defend against this threat is to avoid installing software from untrusted sources and to keep security solutions up to date,” the researchers concluded.
Samsung Galaxy S21 FE: The S21 Affordable Flagship Is Here.
Follow us on Twitter, Telegram and Instagram
2 comments
Comments are closed.