Underground Crypto-Stealing Operation Drained About $100,000
Summary
Netskope researchers detail a Windows malware operation that injects a Vidar-class stealer into browsers, drains cryptocurrency exchange accounts, and swaps copied wallet addresses. They estimate at least 350–430 paying victims and about $100,000 in proceeds.
Key points
- Aotera/Tedy loader samples deliver a Vidar-class stealer by injecting it into a suspended dllhost.exe process; that process launches Chrome or Edge under the victim’s profile.
- The stealer uses rotating gates and browser-injected scripts to target more than 15 exchange and webmail services.
- On Binance, an in-page fake security prompt conceals automated withdrawals, while injected webmail scripts rewrite withdrawal confirmation messages.
- A clipboard clipper replaces copied cryptocurrency wallet addresses with operator-controlled addresses; researchers mapped more than 80 destinations across about two dozen chains.
- Researchers estimate roughly $100,000 in on-chain proceeds and at least 350–430 paying victims; drains were still arriving during the investigation.
- Netskope advises investigating endpoints that contact a gate even if access is blocked, hunting for browser processes launched by dllhost.exe and requests to the campaign’s URI pattern, and verifying withdrawals through a separate channel.
Article Details
- Attack Vectors
- A lure archive containing setup.exe, a trojanized msys-crypto-3.dll, and encrypted data.bin starts the infection; how the archives reach victims is unknown.
- The Underground loader injects a self-decrypting payload into a suspended dllhost.exe process, which launches Chrome or Edge under the victim’s browser profile.
- The stealer injects scripts into authenticated browser sessions to drain cryptocurrency exchange accounts, alter withdrawal-confirmation emails as they appear in webmail, and replace copied wallet addresses with operator addresses.
- Infected machines poll rotating gate domains using /api/machine/* paths; the loader also reports stage telemetry to a panel.
- Defensive Notes
- Treat a blocked gate as an active infection: blocking traffic does not remove the implant. Investigate dllhost.exe injection, Chrome or Edge launched by dllhost.exe, Underground-folder activity, and PNG-named artifacts in AppData\Local.
- Use behavioral URI detection for /api/machine/* alongside domain reputation, and hunt for chrome.exe or msedge.exe requests to those paths on any domain.
- Verify exchange withdrawals through a separate channel because the payload can rewrite confirmation emails as they display in webmail.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | easybooters[.]com | Operator log endpoint domain receiving reports of account-drain steps. |
| DOMAIN | quick-neo[.]com | Example of a hardcoded gate domain used by the stealer to reach its custom command-and-control protocol. |
| DOMAIN | slow-sky[.]com | Rotating gate domain; reported live and serving the operation’s configuration during the investigation. |
| DOMAIN | true-lie[.]com | Rotating gate domain used by the operation. |
| IPV4 | 95[.]164[.]53[.]76 | Underground loader telemetry-panel address receiving loader-stage reports. |
| URL | hxxp[:]//95[.]164[.]53[.]76/new/log/048466C5/startCrypt | Loader telemetry URL recording a startCrypt stage report. |
| URL | hxxp[:]//95[.]164[.]53[.]76/new/log/29A5FDA7/failed/1769331221 | Loader telemetry URL recording a failed stage report. |
| URL | hxxp[:]//95[.]164[.]53[.]76/new/log/29A5FDA7/startLoader/1769331211 | Loader telemetry URL recording a startLoader stage report. |
| URL | hxxp[:]//95[.]164[.]53[.]76/new/log/8320e1a4/startloader/1767499038 | Loader telemetry URL recording a startloader stage report. |
| URL | hxxp[:]//95[.]164[.]53[.]76/new/log/8320E1A4/success/1767499039 | Loader telemetry URL recording a successful stage report. |
| URL | hxxp[:]//95[.]164[.]53[.]76/new/log/D9D278DD/success/1696492954 | Loader telemetry URL recording a successful stage report. |
| URL | hxxps[:]//easybooters[.]com/newlog[.]php | Operator log endpoint identified in the deobfuscated drain configuration. |
MITRE ATT&CK
T1055 · Process InjectionThe loader uses section-based injection to place its payload into a suspended dllhost.exe process.T1057 · Process DiscoveryThe loader compares a hard-coded list of process names against running processes to detect analysis or monitoring environments.T1071.001 · Web ProtocolsInfected machines communicate with rotating gates over the custom /api/machine/* web paths.T1185 · Browser Session HijackingThe stealer injects scripts into the victim’s authenticated Chrome or Edge sessions to manipulate exchange and webmail pages.T1497.001 · System ChecksThe loader checks for virtual-machine and sandbox agent process names as an anti-analysis measure.T1555.003 · Credentials from Web BrowsersThe Vidar-class payload collects Chromium and Gecko cookies and passwords.
Malware
Aotera/TedyAn Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the pages the victim opens.VidarAn Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the pages the victim opens.
Products
BinanceWithin a logged-in Binance session, the injected script renders a fake security-verification dialog as an in-page overlay drawn over the page content, rather than as a separate window, and styles it to mimic Binance’sEdgeAn Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the pages the victim opens.Google ChromeAn Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the pages the victim opens.