SHA1:
- 048b84db369e4854bd8dd38bd3f503dbf2594bbf
Description
This malware takes part in the attack that leverages bogus GitHub repositories to target blockchain game enthusiasts and information security professionals. Trojan.InjectNET.14 tries to inject Trojan.Clipper.688’s code into the legitimate process regasm.exe.
Operation
Trojan.InjectNET.14's source code is packed with Cronos-Crypter. When launched, it injects Trojan.Clipper.688’s code into the legitimate process regasm.exe.
Following its successful deployment, Trojan.Clipper.688 replaces crypto wallet addresses of the user with certain hardcoded addresses. Then the malware generates a message containing its version, a screenshot, an original wallet address, criminals’ wallet address, active window information, current account’s username and IP address, and sends it to the attackers via their Telegram bot.
MITRE ATT@CK MATRIX
| Tactic | Technique |
|---|---|
| Stealth |
Obfuscated files or information (T1027) Process Injection (T1055) |
| Discovery |
Application Window Discovery (T1010) System Owner/User Discovery (T1033) System Network Configuration Discovery (T1016) |
| Collection |
Clipboard Data (T1115) Data from Local System (T1005) Screen Capture (T1113) |
| Command and Control |
Web Protocols (T1071.001) One-Way Communication (T1102.003) |
| Exfiltration | Exfiltration Over Web Service (T1567) |
| Impact | Stored Data Manipulation (T1565.001) |
More about Trojan.Loader.3261
More about JS.Stealer.191
