USB Worm Uses Windows Shortcuts to Spread Cryptocurrency-Stealing Malware
Summary
Microsoft reports a campaign active since at least February that uses malicious USB shortcut files and Tor to spread malware, steal cryptocurrency wallet data, capture screenshots, and execute downloaded JavaScript.
Key points
- Microsoft says infection starts when a victim opens a malicious LNK file on a USB drive; the malware stages additional payloads from a .ONION address over Tor.
- The worm hides local documents and replaces them with same-named malicious shortcuts, then copies itself to newly connected USB drives.
- The malware monitors the clipboard and can replace cryptocurrency wallet addresses with attacker-controlled addresses.
- It searches for BIP39 seed phrases and cryptocurrency private keys, and captures screenshots for exfiltration.
- A C2 EVAL instruction can trigger remote code execution by downloading and running JavaScript.
- Microsoft recommends watching for unusual wscript.exe and cscript.exe activity, unexpected curl, PowerShell, or cmd.exe launches, and Tor proxy activity including connections to localhost:9050.
Article Details
- Attack Vectors
- The infection begins when a victim opens an LNK shortcut on a USB drive.
- The malware hides document originals and replaces them with malicious shortcuts using the same names, causing the malware to run when users open the documents.
- A scheduled task monitors for newly connected USB drives; the malware copies itself to connected drives and creates additional malicious shortcuts.
- The malware stages additional payloads from an .ONION address over Tor.
- The malware monitors clipboard contents for cryptocurrency wallet addresses, seed phrases, and private keys, and replaces wallet addresses with attacker-controlled addresses.
- The malware captures screenshots and sends them to its command-and-control server over Tor.
- A C2 EVAL instruction can trigger the malware to download JavaScript into a file named 'cfile' and execute it.
- Defensive Notes
- Monitor process activity involving wscript.exe and cscript.exe, unexpected launches of curl, PowerShell, and cmd.exe, and unusual child processes.
- Treat connections to localhost:9050 and unexpected Tor proxy activity as red flags associated with the campaign.
- The article reports that behavioral indicators are stronger than signature-based indicators for detecting this infection.
MITRE ATT&CK
T1036 · MasqueradingThe malware disguises shortcuts as documents by giving them the same names and hiding the original files.T1041 · Exfiltration Over C2 ChannelThe malware sends captured screenshots to its C2 server using curl.T1053.005 · Scheduled TaskThe worm creates a scheduled task to monitor for newly connected USB storage devices.T1059.007 · JavaScriptThe malware executes downloaded JavaScript after a C2 EVAL instruction.T1090.003 · Multi-hop ProxyThe malware uses Tor to conceal command-and-control communications.T1091 · Replication Through Removable MediaThe malware copies itself to newly connected removable drives and creates malicious shortcuts to spread.T1105 · Ingress Tool TransferThe malware stages additional payloads and downloads JavaScript content from its C2.T1113 · Screen CaptureThe malware captures five screenshots every ten seconds.T1115 · Clipboard DataThe stealer repeatedly checks the clipboard for cryptocurrency addresses, seed phrases, and private keys, and replaces wallet addresses.T1204.002 · Malicious FileThe infection starts when a victim opens a malicious LNK file on a USB drive or opens a document replaced with a same-named malicious shortcut.
Tools
curlApart from monitoring the clipboard, the malware also captures five screenshots of the victim’s screen every ten seconds and sends them to the C2 using the curl tool.TorMicrosoft reported a clipper malware campaign that has been active since at least February, using LNK files on USB drives and the Tor network to steal cryptocurrency wallet data and hide command-and-control traffic.