December 2018’s Most Wanted Malware: Where there’s SmokeLoader, there’s Fire

guest · Jan 14, 2019

December 2018’s Most Wanted Malware: Where there’s SmokeLoader, there’s Fire
January 14, 2019
https://blog.checkpoint.com/2019/01...alware-smokeloader-crypto-malware-ransomware/

Despite an overall drop in value across all cryptocurrencies in 2018, cryptomining malware makes up half of all places in the top 10 list and fills the top 4 positions. Coinhive remains the most prevalent malware for the 13th consecutive month, impacting 12% of organizations worldwide.

The remaining positions have been filled by damaging, multi-purpose malware forms that use multiple methods to distribute a variety of threats. Emotet, an advanced Trojan used as a malware distributor jumped to 5th place, and Ramnit – a banking Trojan that steals login credentials and other sensitive data returned to the top 10 this month at 8th place.
Click to expand...

December 2018’s Top 10 ‘Most Wanted’:

*The arrows relate to the change in rank compared to the previous month.

↔ Coinhive – Cryptominer designed to perform online mining of Monero cryptocurrency when a user visits a web page without the user’s knowledge or approval, and without sharing the profits with the user. The implanted JavaScript uses great computational resources of the end users to mine coins and might crash the system.

↑ XMRig – Open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in-the-wild on May 2017.

↑ Jsecoin – JavaScript miner that can be embedded in websites. With JSEcoin, you can run the miner directly in your browser in exchange for an ad-free experience, in-game currency and other incentives.

↓ Cryptoloot – Cryptominer, using the victim’s CPU or GPU power and existing resources for cryptomining – adding transactions to the blockchain and releasing new currency. It is a competitor to Coinhive, trying to pull the rug under it by asking a smaller percentage of revenue from websites.

↑ Emotet – Advanced, self-propagate and modular Trojan. Emotet once used to employ as a banking Trojan, and recently is used as a distributor to other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.

↑ Nivdort – Multipurpose bot, also known as Bayrob, that is used to collect passwords, modify system settings and download additional malware. It is usually spread via spam emails with the recipient address encoded in the binary, thus making each file unique.

↓ Dorkbot – IRC-based Worm designed to allow remote code execution by its operator, as well as the download of additional malware to the infected system.

↑ Ramnit – Banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.

↑ Smokeloader – Second-stage downloader for windows which is used to download other malwares or other plugins. Smokeloader uses various anti-analysis tricks that is used for deception and self-protection. Smokeloader is commonly used to load a lot of known families, including the Trickbot trojan, Azorult infostealer and Panda banker.

↑ Authedmine – A version of the infamous JavaScript miner CoinHive. Similarly to CoinHive, Authedmine is a web-based crypto miner used to perform online mining of Monero cryptocurrency when a user visits a web page without the user’s knowledge or approval the profits with the user. However unlike CoinHive Authedmine is designe to require the website user’s explicit consent before running the mining script.

guest · Nov 11, 2022

SmokeLoader campaign distributes new Laplas Clipper malware
By Pierluigi Paganini - November 8, 2022

Cyble researchers uncovered a SmokeLoader campaign that is distributing community malware, such as SystemBC and Raccoon Stealer 2.0, along with a new clipper malware tracked as Laplas.

The experts detected more than 180 different samples of the clipper malware in the last two weeks, a circumstance that confirms that the threat has been widely deployed in recent weeks.
Clipper is a family of malware designed to hijack cryptocurrency transactions by swapping the victim’s wallet address with the wallet address owned by attackers.
Click to expand...

Laplas uses a trick to avoid detection, it generates a wallet address similar to the victim’s wallet address.

“Laplas is new clipper malware that generates a wallet address similar to the victim’s wallet address. The victim will not notice the difference in the address, which significantly increases the chances of successful clipper activity.” reads the post published by Cyble.
Click to expand...

“Smoke Loader is a well-known, highly configurable, effective malware that TAs are actively renovating. It is a modular malware, indicating it can get new execution instructions from C&C servers and download additional malware for expanded functionality. In this case, the TAs use three different malware families for financial gain and other malicious purposes.” concludes the report.
“The RecordBreaker, a revived version of Raccoon Stealer, is used to steal sensitive information, the SystemBC is a multifunctional threat combining proxy and remote access trojan features, and the new Laplas clipper performs clipboard hijacking to steal cryptocurrency from victims.”
Click to expand...

Cyble: New Laplas Clipper Distributed Via SmokeLoader

Cyble Research and Intelligence Labs (CRIL) has continuously monitored malware campaigns that distribute different malware families, such as stealer, clipper, and ransomware.

Recently, CRIL observed a malware strain known as SmokeLoader, which carries popular malware family samples such as SystemBC and Raccoon Stealer 2.0, along with a new clipper malware dubbed Laplas Clipper that targets cryptocurrency users.
Click to expand...

SmokeLoader
SmokeLoader is primarily a loader; its intended purpose is to download and load other malware into the victim’s system.
Generally, the SmokeLoader is either distributed via malicious documents such as Word/PDF documents, sent through spam emails, or targeted spear-phishing attacks.

Upon execution of SmokeLoader, it injects malicious code into the “explorer.exe” process and starts its malicious activity.
Click to expand...

Log in or Sign up

December 2018’s Most Wanted Malware: Where there’s SmokeLoader, there’s Fire

guest Guest

guest Guest

Log in or Sign up

December 2018’s Most Wanted Malware: Where there’s SmokeLoader, there’s Fire

guest Guest

guest Guest

Useful Searches