Introduction to the USB Worm
A recent campaign has been discovered where threat actors are distributing clipboard-stealing malware with self-spreading capabilities, using the Tor network to conceal communication. This campaign has been active since at least February and relies on LNK (shortcut) files on USB drives to push clipper malware.
The malware monitors clipboard contents and replaces cryptocurrency wallet addresses with ones controlled by the attacker. Additionally, it monitors for seed phrases and private keys, and can capture screenshots that are exfiltrated over Tor.
Infection and Worm Propagation
According to Microsoft, the infection process starts with the victim opening the LNK file, triggering the malware on the USB drive. Additional payloads are staged from a .ONION address. A local scan searches for document files on the system.
When such files are found, the malware hides the originals and replaces them with malicious shortcuts bearing the same names. This causes the malware to execute when users attempt to open the documents. The worm creates a scheduled task that monitors for newly connected USB storage devices.
When a removable drive is connected, the malware copies itself to the device and creates additional malicious shortcut files. This self-spreading capability allows the malware to propagate quickly and easily.
Execution Flow Overview
The execution flow of the malware is complex and involves multiple steps. The stealer component in the malware executes after checking that Task Manager is inactive, establishing communications with the command-and-control (C2) host using a Tor executable (ugate.exe).
Every half a second, the malware checks the clipboard for specific data, including 12-word BIP39 seed phrases, 24-word BIP39 seed phrases, Ethereum private keys, Bitcoin WIF keys, and various wallet addresses. The targeted addresses are chosen based on their starting digits or characters to partially resemble the attackers’ wallet addresses.
Data Stealer and Screenshot Capture
Apart from monitoring the clipboard, the malware also captures five screenshots of the victim’s screen every ten seconds and sends them to the C2 using the curl tool. According to Microsoft, there is also support for remote code execution, which can be triggered by a C2 EVAL instruction.
Specifically, the malware downloads JavaScript content into a file named ‘cfile,’ and executes it on the infected machine. This allows the attackers to execute arbitrary code on the infected system, further increasing the malware's capabilities.
Indicators of Infection
The strongest indicators of an infection are behavioral rather than signature-based. Security teams should monitor for process activity on wscript.exe and cscript.exe, unexpected launches of curl, PowerShell, and cmd.exe, along with unusual child processes.
Connections to ‘localhost:9050’ and Tor proxy activity are also red flags associated with this campaign. By monitoring these indicators, security teams can quickly identify and respond to infections.
Conclusion
The USB worm spreading crypto-stealing malware is a significant threat to cryptocurrency users. Its self-spreading capabilities and use of the Tor network make it difficult to detect and track. By understanding the malware's execution flow and indicators of infection, security teams can take steps to protect their systems and prevent further infections.
Source: BleepingComputer