New Malware Filching Bitcoin and Passwords out of Crypto-currency Wallets

Internet security company Cyren recently detected one fresh malware which is capable of filching passwords and bitcoin out of crypto-currency wallets accessed over Internet-connected PCs. The company blogged that the malicious software was mainly targeting banking clients, while scale of the attack was pretty massive that primarily targeted users in USA and Singapore.

The malware gets served through an executable attached to electronic mails regarding bank transfers. People receiving the e-mails believe they've got some deposit while that easily deceives them. By using bots, the cyber-crooks produce fake e-mails which seem as coming from reliable and major banks like DBS, and Emirates NDB.

Cyren researchers explain that after execution the malicious software erases itself as well as creates a file which is named Filename.vbs. The said file gets constructed inside Windows OS' startup folder. Every time the victim logs into his PC or reboots his system following a sign out process, the malicious program begins running again with the file getting placed inside the folder named AppData\Local\Temp\subfolder. Hackread posted this online dated February 1, 2017.

It has been analyzed that the malicious software is created for identifying and investigating registry to garner crucial particulars such as data pertaining to computer programs loaded and passwords from the infected computer. Concentration is on web-browsing applications and FTP alternatively, software which consists of user credentials. The malicious software garners data when web-browsers are running on the host PC while hunts to get crucial details like usernames and passwords, history, cache and cookies. Moreover, it searches e-mail clients.

The malicious program has the characteristics of a keylogger because it records all keystrokes the end-user makes on his keyboard. Indeed it also logs mouse clicks' locations. The various crypto-currencies the malware has targeted hitherto are Litecoin, Namecoin, Bitcoin, Bytecoin, BBQcoin, Anoncoin, Digitalcoin, Devcoin, Craftcoin, Florincoin, Feathercoin, Fastcoin, Infinitecoin, 10coin, Freicoin, Luckycoin, Junkcoin, Ixcoin, Phoenixcoin, Mincoin, Megacoin, Tagcoin, Quarkcoin, Primecoin, Zetacoin, Yacoin, Worldcoin and Terracoin.

Like always, users are reminded not to take down anything from unsolicited electronic mails, not follow unknown web-links as well as use social engineering tactics prior to trusting an e-mail writer.

» SPAMfighter News - 2/6/2017