- SHA1: 452e2e3a77e1d8263d853c69440187e052ee3f0a
Description
An Android trojan based on the MetaMask open source crypto wallet software. It steals mnemonic seed phrases used to access crypto wallets and sends them to the attackers’ server. Malware creators distribute this trojan through specially created malicious websites that copy the appearance of MetaMask project’s genuine website.
A comparison between the genuine website (left) and fake one (right):
Operating routine
The Android.CoinSteal.7 is a full-fledged version of the MetaMask application with implanted malicious functionality. It looks and operates just like the original safe version. The data theft goes unnoticed by the users.
Upon launch, the trojan displays the app’s main menu. There, the user can either create new crypto wallets or import already existing ones.
In both cases, the user has to enter their seed phrase for authorization into the corresponding field. At that, the seed phrase is covertly sent to the C&C server located at hxxps://admin[.]metamaskio[.]vip/api/posstkey.
