Your copy-paste habit can cost you your money

Credit to Author: Anant Pulgam| Date: Thu, 19 Jul 2018 07:40:40 +0000

Estimated reading time: 4 minutesHow often do you store your important data in files? It’s very common, right? This data may be URLs, topics, personal data like contacts, email-ids, usernames of different portals and sometimes passwords too (though always recommended to not to do so). We very casually copy this data and paste it in respective applications. In the past, we have seen some spyware using this clipboard data. Upon hitting Ctrl+C, this data is stored on clipboard and malware just gathers data from clipboard and send it to the attacker. But, what if this data is altered during its use? It can lead to a huge loss if this data is very sensitive such as your bank details, financial information or cryptocurrency wallet addresses. Cryptocurrency has been on the radar of malware authors from last few years and they are definitely making a profit out of it as they not losing focus on it. Any cryptocurrency account (wallet) is represented by some unique wallet address. These addresses are difficult to remember as they are a combination of numbers and letters with longer lengths. For all the crypto-transactions, these addresses are used. So, often we store these addresses in some text files in order to use whenever needed. Malware authors are exploiting this habit of copy-pasting to make a profit out of it. We analyzed a new way of digital funds theft i.e. “Trojan.CBHAgent”. This Trojan monitors the Windows clipboard for cryptocurrency addresses being copied onto the clipboard. Once it detects any bitcoin address, it will be replaced by one of the bitcoin address from list maintained in the file. A user will not easily be able to identify address is different until he confirms it manually again. Before looking into the working of the Trojan, we need to know what the clipboard is. Clipboard is a shared memory area that you can copy data into and copy data from. All applications have access to this clipboard, data can be easily transferred between applications. Clipboard is used by Windows while cutting, copying, or pasting data. Clipboard is supported with a set of functions that enable applications to transfer or exchange data. Windows provides APIs for managing clipboard. GetClipboardData is used to fetch the current (copied) data on clipboard and SetClipboardData is used for saving data on the clipboard (I.e. generally when Ctrl+C is pressed). Analysis: Trojan ‘Trojan.CBHAgent’ is using these Windows API’s to manipulate the clipboard data. Fig. 1 – Clipboard APIs present in the file. It is a dropped DLL on victims system that will be run using rundll32.exe, a DLL host, with below command line. $> C:WINDOWSsystem32rundll32.exe “C:Documents and SettingsAdministratorDesktopSampleCBHAgent.dll”,includes_func_runnded Here ‘includes_func_runnded’ is an exported function which performs the clipboard monitoring. Also, for preventing its analysis, the author checked whether it is being run in virtual machine or not. Trojan is also exported ‘detection_VMx’ function to use it as anti-VM check. Looking at its file structure, it is found that the Trojan sample is packed with PECompact packer to make analysis more difficult. List of bitcoin addresses which are to be pasted, are present in resource of file as plain text. More than 2.3 million bitcoin addresses are listed out in the file. All these addresses are sorted so that it would help while searching the target bitcoin address. This resulted the file size to 80 MB. Fig. 2 Bitcoin addresses present in plain text format. On execution, it starts monitoring clipboard data continuously and checks if there is any like bitcoin address. For validation, it uses regular expression. Once matched, it be replaced with a address present list. The Trojan is not affecting any data other than bitcoin addresses. Fig 3: Regular expression check for Bitoin address in clipboard data. This malware runs in the background so users are not easily able to identify getting infected by Trojan.CBHAgent. We strongly recommend you to double check bitcoin address while doing any bitcoin transaction. The trojan also ensures its persistence in the system by creating a copy in %TEMP% directory and adding its run entry in registry. It creates a mutex with name as ‘MODULE_DXDIAG_1’. Quick Heal detects the Trojan as ‘Trojan.CBHAgent.S3076164’. Indicator of compromise: 48b66dd02a336eb049a784b3fd1beb5312fb8c078b3729d49e92e3e986c98e91 Conclusion: This malware would attract the other malware authors for…
http://blogs.quickheal.com/feed/