Crypto Theft Malware in Telegram Channel | SafeGuard Cyber

Target:
Cryptocurrency traders and firms

Communication Channels:
Mobile Chat Groups

Executive Summary

SafeGuard Cyber detected a remote access trojan (RAT) posted to a Telegram discussion channel in June 2022.

It is unknown if it was part of a coordinated campaign, or if it was simply mass targeting users of the channel.

Background

In June 2022, SafeGuard Cyber detected a Trojan posted in a public crypto Telegram channel that we monitor as part of our work with our financial service customers. We analyzed and identified the malware sample as a generic Trojan and reviewed the messages surrounding the post.

Event Analysis

SafeGuard Cyber believes this Trojan was meant to target new or unsuspecting users of the channel and is used to steal cryptocurrency keys.

• The handle “港島輝達資本” (Chinese for “Hong Kong Island Huida Capital”) and the handle “Your Grace” were used on the channel to attempt to spread the malware.
• The handle “Your Grace” was seen attempting to post an archive file containing the malware, but no further messaging was seen from the handle.
• The handle “港島輝達資本” posted many messages, including various image files, and one of them appeared to be the malware. The lure appears to be spamming images until a victim inadvertently clicks on the attachment.
• The “港島輝達資本” handle was seen having routine conversations within the channel.
• The post did not appear to be a response to any of the surrounding messages in the channel.

We did not find that anyone responded to either handle or complain about the file, though this does not prove that users of the channel did not get infected.

Malware Summary

After execution, a command prompt window is displayed and what appears to be an error window appears with indiscernible text. After the user hits ‘enter’ in the command prompt window, it pings the localhost. The program then exits and the application removes itself from the desktop and runs as “Skc3sk.exe”. It also makes a copy in the SYSWoW64 folder and tries to hide itself as an operating system file. The task “Skc3sk.exe” runs persistently in the background. It’s assumed that the callout and ping command is meant to beacon the attacker that the connection is active.

The malware also appears to create hidden copies of the victims’ private and public key store. Since this malware was detected in a cryptocurrency platform, it can be assumed that this malware is targeting victim keys used for cryptocurrency. In addition, since the method used to hide the additional program was dropped in the SYSWOW64 folder, it can mean that this malware could be used as a backdoor.

No further activity was found regarding this sample.

Technical Details

Filename:
#01.exe

File Creation Date:
May 8 2022

Hashes:
MD5: 26f9be65373c00e14f21e90a53b23f36
SHA1: 3ec0a7cd02ed8a3575ea02fce967e6047015505b
SHA256: 40c7f0ef1fe74c46cb486b2fb026a547fafd93507ddf0cf0919fdd150c68929a

Disposition:
Malicious - Trojan

Dropped Files:
C:\ProgramData\PuppetLabs\puppet\etc\ssl\private_keys\msedgewin10.pem
C:\ProgramData\PuppetLabs\puppet\etc\ssl\public_keys\msedgewin10.pem
C:\Users\All Users\PuppetLabs\puppet\etc\ssl\private_keys\msedgewin10.pem
C:\Users\All Users\PuppetLabs\puppet\etc\ssl\public_keys\msedgewin10.pem
C:\Windows\SysWOW64\Skc3sk.exe

Persistence:
This sample does not establish persistence

Network Traffic:
202.95.15.26:8520

Skc3sk.exe

Hashes:
MD5: 4d104eed48acba38f9b6544820a00407
SHA-1: 8abde557a32b022341153b52288cdcb7ef8c55e4
SHA-256:25a604e9ead508d18b50f379d26b3a2edfd7c395f8fc4298f8fddb4037b332e6

IOCs
– MD5 Hash: 26f9be65373c00e14f21e90a53b23f36
– MD5 Hash: 4d104eed48acba38f9b6544820a00407
– IP: 202.95.15.26:8520

Key Takeaways

• This attack didn’t appear to be targeted directly at a particular user and was just trying to lure a user to inadvertently download the malware.
• SafeGuard Cyber believes that the attacker was attempting to mask the malicious file as an image document.
• The Trojan has backdoor functions as well as data stealing functions targeting cryptocurrency authentication tokens on the victims machine

If you are interested in learning more about the SafeGuard Cyber solution, you can take a quick 5-minute tour.