Attackers Using ElectroRAT Malware To Target Cryptocurrency Users

Network safety scientists today uncovered a wide-running fraud focusing on cryptographic money clients that started as ahead of schedule as of January a year ago to spread trojanized applications to introduce a formerly undetected remotely accessible tool on targeted devices.

The RAT is composed by a ground-up in Golang and intended to focus on various working operating systems, for example, Windows, Linux, and macOS. It was first called ElectroRAT by Intezer. Such applications are created utilizing the open-source Electron cross-stage desktop application structure.

The specialists explain that the ElectroRAT can be considered the most recent illustration of hackers taking advantage of Golang to create multi-stage malware and dodge most antivirus applications. Also stated that “It is common to see various information stealers trying to collect private keys to access victims wallets. However, it is rare to see tools written from scratch and targeting multiple operating systems for these purposes”.

The mission was first identified in December and is assumed to have affected more than 6,500 victims dependent on the quantity of every single new guest arriving on Pastebin pages consumed to find the command and control (C2) servers.

“Operation ElectroRAT” included the hackers making three separate spoiled applications each for a Windows, Linux, and Mac version, two of which act like digital money exchange management applications by the title of “Jamm” and “eTrade,” and the third application called “DaoPoker” takes the appearance of a cryptocurrency poker stage. These malicious applications aren’t built primarily for any specific events or missions and the services of these applications are additionally given publicity on Twitter, Telegram, and other authentic cryptographic money and blockchain-related discussion platforms, for example, “bitcointalk” and “SteemCoinPan” trying to draw clueless clients into downloading the corrupted applications (digital money malwares).

As soon as the application is installed, the ElectroRAT hidden in the background (named as mdworker) executes in stealth mode while a user interface with a safe look is displayed on the front end of the user. This ElectroRAT comes with the capabilities to store keystrokes, download arbitrary code files, upload files from the system, take screenshots and receive and execute commands on the victim’s device, received directly from the command and control server.

Strangely, an investigation of the Pastebin pages which was made public by a client named “Execmac” on January 8, 2020, and those posted by a similar client preceding the mission discovered command and control servers utilized in Windows malware like Amadey and KPOT, hinting that the hackers have turned away from the use of notable trojans and turned towards RAT equipped with the intention to focus on various working operating systems.

Researchers explain how an obscure Golang malware permitted the mission to stay under the radar but out of sight for a year by dodging all antivirus scans. Victims of this mission are encouraged to slaughter the cycle by erasing all documents identified with the malware, transferring the assets to another wallet, and changing passwords to cryptocurrency accounts.

If you like this article, follow us on Twitter, Facebook, Instagram, and Linkedin.