Pierluigi Paganini July 02, 2018

A sample of CryptoCurrency Clipboard Hijackers discovered this week by BleepingComputer monitors for more than 2.3 million addresses.

Almost any people that have to send cryptocurrency coins use to copy the recipient wallet address into memory from one application and use it to make the transaction.

Crooks’ interest in cryptocurrency continues to grow and new malware was specifically designed to recognize wallet addresses in the memory of infected computers and use it for fraudulent activities, such as the hijacking of transactions.

This family of malware is called CryptoCurrency Clipboard Hijackers, the malware monitors the Windows clipboard for cryptocurrency addresses, and if one is detected, it then replaces the address in the clipboard with the attacker’s one.

With this simple trick when the user pastes the address he will send the coins to the attacker.

What is the peculiarity of a sample of cryptocurrency clipboard hijackers recently discovered by researchers at Bleeping Computer?

While most of the previous samples monitored for 400-600 thousand cryptocurrency addresses, the sample discovered this week by BleepingComputer monitors for more than 2.3 million cryptocurrency addresses.

The following video shows how CryptoCurrency Clipboard Hijackers replace cryptocurrency addresses found within the Windows clipboard.

The only way to prevent such kind of attacks is double-checking the pasted address.

The infection was associated with the recent campaign that targeted Windows computers with so-called All-Radio 4.27 Portable malware package.

“If your computer is suddenly displaying the above program, then your computer is infected with malware that installs rootkits, miners, information-stealing Trojans, and a program that is using your computer to send out spam.” reads a post published by BleepingComputer.

Once the malicious code is installed, a DLL named d3dx11_31.dll will be downloaded to the Windows Temp folder and an autorun called “DirectX 11” will be created to run the library everytime a user logs into the computer.

“This DLL will be executed using rundll32.exe with the “rundll32 C:\Users\[user-name]\AppData\Local\Temp\d3dx11_31.dll,includes_func_runnded” command.”

As usual, let me suggest using an up to date antivirus solution to detect and neutralize these threats.

Pierluigi Paganini

(Security Affairs – CryptoCurrency Clipboard Hijackers, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]