ESET Research discovers KryptoCibule: The multitasking multicurrency cryptostealer

guest · Sep 2, 2020

ESET Research discovers KryptoCibule: The multitasking multicurrency cryptostealer
KryptoCibule spreads through malicious torrents and threaten cryptocurrencies
September 1, 2020
https://www.pcr-online.biz/2020/09/...the-multitasking-multicurrency-cryptostealer/

ESET researchers have discovered a previously undocumented trojan malware family that spreads through malicious torrents and that uses multiple tricks to squeeze as many cryptocoins as possible from its victims while staying under the radar. ESET named the threat KryptoCibule, and according to ESET telemetry the malware seems to primarily target users in the Czech Republic and Slovakia.

This malware is a triple threat in regard to cryptocurrencies. It uses the victim’s resources to mine coins, tries to hijack transactions by replacing wallet addresses in the clipboard and exfiltrates cryptocurrency-related files, all while deploying multiple techniques to avoid detection. KryptoCibule makes extensive use of the Tor network and the BitTorrent protocol in its communication infrastructure.

“The malware, as written, employs some legitimate software. Some, such as Tor and the Transmission torrent client, are bundled with the installer; others are downloaded at runtime, including Apache httpd and the Buru SFTP server,” says Matthieu Faou, ESET Researcher who uncovered the new malware family.
ESET has identified multiple versions of KryptoCibule, enabling us to trace its evolution all the way back to December 2018; it remains active. New capabilities have regularly been added to the malware over its lifetime, and it is under constant development.
Click to expand...

Most of the victims were in Czech Republic and Slovakia, and this reflects the user base of the site on which the infected torrents are found. Almost all the malicious torrents were available on uloz.to, a popular file sharing site in the two countries.

Additionally, KryptoCibule specifically checks for ESET, Avast and AVG endpoint security products; ESET is headquartered in Slovakia, while the other two are owned by Avast, which is headquartered in the Czech Republic.
Click to expand...

guest · Sep 2, 2020

mood said: ↑

ESET Research discovers KryptoCibule: The multitasking multicurrency cryptostealer September 1, 2020
Click to expand...

ESET: KryptoCibule: The multitasking multicurrency cryptostealer

ESET researchers analyze a previously undocumented trojan that is spread via malicious torrents and uses multiple tricks to squeeze as many cryptocoins as possible from its victims while staying under the radar
On top of the crypto-related components, KryptoCibule also has RAT functionality. Among the commands it supports are EXEC, which allows execution of arbitrary commands and SHELL, which downloads a PowerShell script from the C&C. This script then loads a backdoor generated with the post-exploitation tool Pupy.

The name KryptoCibule derives from the Czech and Slovak words for “crypto” and “onion”.
Initial Compromise
KryptoCibule is spread through malicious torrents for ZIP files whose contents masquerade as installers for cracked or pirated software and games.
The BitTorrent protocol is also used to download updates to the malware, and additional software. [...]
Click to expand...

Conclusion
The KryptoCibule malware has been in the wild since late 2018 and is still active, but it doesn’t seem to have attracted much attention until now. Its use of legitimate open-source tools along with the wide range of anti-detection methods deployed are likely responsible for this.
The relatively low number of victims (in the hundreds) and their being mostly confined to two countries may also contribute to this.

Presumably the malware operators were able to earn more money by stealing wallets and mining cryptocurrencies than what we found in the wallets used by the clipboard hijacking component. The revenue generated by that component alone does not seem enough to justify the development effort observed.
Click to expand...

guest · Sep 2, 2020

KryptoCibule malware dodges antivirus to steal cryptocurrency
September 1, 2020
https://www.bleepingcomputer.com/ne...-vcruntime140dll-is-missing-error-how-to-fix/

Threat researchers discovered a new malware family that is fully focused on getting as much cryptocurrency as possible from its victims. For this purpose, it steals wallets, hijacks transactions, and starts mining on infected machines.

Named KryptoCibule, the malware has managed to stay under the radar for almost two years, extending its functionality with each new version.
Dodging antivirus solutions
In a technical analysis released today, researchers at ESET note that KryptoCibule relies heavily on the Tor network to communicate with its command and control (C2) servers.
This drill, along with the fact that it seems to target users in the Czech Republic and Slovakia (more than 85% of ESET’s detections are from these countries), allowed the malware to avoid attention for so long.
Evasion tactics do not stop at this, though. Executing the payload happens only if processes for specific analysis software are missing on the computer.
Click to expand...

Apart from its focus on cryptocurrency, the threat features other tools that give its operators remote access to the compromised host.
To add other tools on an infected computer, the malware installs the Transmission BitTorrent client, which receives remote commands via the RPC interface on the default port.
Click to expand...

Log in or Sign up

ESET Research discovers KryptoCibule: The multitasking multicurrency cryptostealer

guest Guest

guest Guest

guest Guest

Log in or Sign up

ESET Research discovers KryptoCibule: The multitasking multicurrency cryptostealer

guest Guest

guest Guest

guest Guest

Useful Searches