Newly Discovered Malware Has Arsenal of Tricks to Help It Steal Crypto
Cybersecurity researchers said "KyberCibule" covertly mines for privacy coin monero and could also steal victims' passwords and divert crypto funds.
Sep 2, 2020 at 3:58 p.m. UTCUpdated Aug 19, 2021 at 4:06 a.m. UTC
:format(webp)/cloudfront-us-east-1.images.arcpublishing.com/coindeskuat/4QIAZ75JWNE23IZ234ZBYYHOVI.jpg)
An advanced form of cryptocurrency-targeting malware shared through pirated software and games downloaded from torrent sites poses multiple threats to victims.
- In a report Wednesday, researchers at Slovakian cybersecurity firm ESET said they had found malicious code within the installer program for media files that contains a cryptocurrency mining bot.
- However, the malware has evolved in its two years of existence to possess other tricks that are more concerning to users of cryptocurrency.
- Dubbed "KryptoCibule" – a combination of the Czech and Slovak words for "cryptocurrency" and "onion" – the malware can also change a wallet address to one linked to the hacker when pasted from the clipboard, potentially diverting funds sent to the victim.
- Further, it will hunt for, and steal, cryptocurrency passwords, private keys or key phrases stored on the host machine's hard drive.
- The malware is spread by users sharing the affected media files on peer-to-peer file-sharing networks.
- It also updates itself using BitTorrent, which was acquired by Tron in mid-2018, the researchers said.
- ESET said KryptoCibule had stolen roughly $1,800 in bitcoin and ether by changing victims' wallet addresses.
- They were unable to determine how much the hacker stole through the mining bot or from stealing passwords.
13:18
Bitcoin Mining in the U.S. Will Become 'a Lot More Decentralized': Core Scientific CEO
05:10
Binance to Discontinue Its Nigerian Naira Services After Government Scrutiny
04:07
The first video of the year 2024
40:07
The last regression video of the year 3.67.0
:format(webp)/cloudfront-us-east-1.images.arcpublishing.com/coindeskuat/BFOMWB27Y5GFFIHJ47WTLYOHDU.png)
STORY CONTINUES BELOW
- KryptoCibule likely started operation in late 2018 but has remained hidden till now thanks to being designed to evade detection.
- KryptoCibules hides in files that work normally, so victims are less likely to suspect anything amiss. It also actively watches for, and hides from, antivirus tools such as Avast.
- In addition, it contains a command line to the Tor browser that encrypts communications and makes it impossible to trace the mining server behind KryptoCibule.
- KryptoCibule also monitors the computer's battery so it doesn't consume too much power and thus get noticed.
- If the battery falls below 30%, KryptoCibule shuts off the GPU miner and runs its monero miner at a much lower capacity. The whole program shuts down should battery go under 10%.
- Despite its sophistication, ESET said the bot had so far only been downloaded by several hundred computers, mostly based in Czechia and Slovakia.
:format(webp)/downloads.coindesk.com/arc/failsafe/user/1x1.png)