Lazarus Group used a brand new type of malware in an try and compromise a crypto trade, based on an Oct. 31 report from Elastic Safety Labs.
Elastic has named the brand new malware “Kandykorn” and the loader program that masses it into reminiscence “Sugarload,” because the loader file has a novel “.sld” extension in its identify. Elastic didn’t identify the trade that was focused.
Crypto exchanges have suffered a rash of private-key hacks in 2023, most of which have been traced to the North Korean cybercrime enterprise Lazarus Group.
Based on Elastic, the assault started when Lazarus members posed as blockchain engineers and focused engineers from the unnamed crypto trade. The attackers made contact on Discord, claiming that they had designed a worthwhile arbitrage bot that might revenue from discrepancies between the costs of cryptocurrencies on completely different exchanges.
The attackers satisfied the engineers to obtain this “bot.” The information in this system’s ZIP folder had disguised names like “config.py” and “pricetable.py” that made it look like an arbitrage bot.
As soon as the engineers ran this system, it executed a “Most important.py” file that ran some bizarre packages in addition to a malicious file referred to as “Watcher.py.” Watcher.py established a connection to a distant Google Drive account and commenced downloading content material from it to a different file named testSpeed.py. The computer virus then ran testSpeed.py a single time earlier than deleting it so as to cowl its tracks.
Through the single-time execution of testSpeed.py, this system downloaded extra content material and finally executed a file that Elastic calls “Sugarloader.” This file was obfuscated utilizing a “binary packer,” Elastic acknowledged, permitting it to bypass most malware detection packages. Nevertheless, they had been capable of uncover it by forcing this system to cease after its initialization features had been referred to as, then snapshotting the method’ digital reminiscence.
Based on Elastic, it ran VirusTotal malware detection on Sugarloader, and the detector declared that the file was not malicious.
Associated: Crypto companies beware: Lazarus’ new malware can now bypass detection
As soon as Sugarloader was downloaded onto the pc, it linked to a distant server and downloaded Kandykorn straight into the machine’s reminiscence. Kandykorn comprises quite a few features that can be utilized by the distant server to carry out numerous malicious actions. For instance, the command “0xD3” can be utilized to record the contents of a listing on the sufferer’s pc, and “resp_file_down” can be utilized to switch any of the sufferer’s information to the attacker’s pc.
Elastic believes that the assault occurred in April 2023. It claims that this system might be nonetheless getting used to carry out assaults in the present day, stating:
“This risk continues to be energetic and the instruments and methods are being constantly developed.”
Centralized crypto exchanges and apps suffered a rash of assaults in 2023. Alphapo, CoinsPaid, Atomic Pockets, Coinex, Stake and others have been victims of those assaults, most of which appear to have concerned the attacker stealing a non-public key from the sufferer’s machine and utilizing it to switch prospects’ cryptocurrency to the attacker’s handle.
America Federal Bureau of Investigation has accused the Lazarus Group of being behind the Coinex hack, in addition to performing the Stake assault and others.
