Doctor Web identifies pirated Windows builds with crypto stealer that penetrates EFI partition

FanJ · Jun 14, 2023

https://news.drweb.com/show/?i=14712&lng=en&c=5
June 13, 2023

Doctor Web has discovered a malicious clipper program in a number of unofficial Windows 10 builds that cybercriminals have been distributing via a torrent tracker. Dubbed Trojan.Clipper.231, this trojan app substitutes crypto wallet addresses in the clipboard with addresses provided by attackers. As of this moment, malicious actors have managed to steal cryptocurrency in an amount equivalent to about $19,000 US.
Click to expand...

The malicious apps in these builds are located in the system directory:
\Windows\Installer\iscsicli.exe (Trojan.MulDrop22.7578)
\Windows\Installer\recovery.exe (Trojan.Inject4.57873)
\Windows\Installer\kd_08_5e78.dll (Trojan.Clipper.231)
Click to expand...

Read there more.

Log in or Sign up

Doctor Web identifies pirated Windows builds with crypto stealer that penetrates EFI partition

FanJ Updates Team

Log in or Sign up

Doctor Web identifies pirated Windows builds with crypto stealer that penetrates EFI partition

FanJ Updates Team

Useful Searches