{"id":86531,"date":"2018-07-19T13:10:40","date_gmt":"2018-07-19T07:40:40","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=86531"},"modified":"2018-07-23T11:17:11","modified_gmt":"2018-07-23T05:47:11","slug":"copy-paste-habit-can-cost-money","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/copy-paste-habit-can-cost-money\/","title":{"rendered":"Your copy-paste habit can cost you your money"},"content":{"rendered":"

How often do you store your important data in files? It\u2019s very common, right? This data may be URLs, topics, personal data like contacts, email-ids, usernames of different portals and sometimes passwords too (though always recommended to not to do so). We very casually copy this data and paste it in respective applications. In the past, we have seen some spyware using this clipboard data. Upon hitting Ctrl+C, this data is stored on clipboard and malware just gathers data from clipboard and send it to the attacker. But, what if this data is altered during its use? It can lead to a huge loss if this data is very sensitive such as your bank details, financial information or cryptocurrency wallet addresses.<\/p>\n

Cryptocurrency has been on the radar of malware authors from last few years and they are definitely making a profit out of it as they not losing focus on it. Any cryptocurrency account (wallet) is represented by some unique wallet address. These addresses are difficult to remember as they are a combination of numbers and letters with longer lengths. For all the crypto-transactions, these addresses are used. So, often we store these addresses in some text files in order to use whenever needed. Malware authors are exploiting this habit of copy-pasting to make a profit out of it.<\/p>\n

We analyzed a new way of digital funds theft i.e. \u201cTrojan.CBHAgent\u201d. This Trojan monitors the Windows clipboard for cryptocurrency addresses being copied onto the clipboard. Once it detects any bitcoin address, it will be replaced by one of the\u00a0bitcoin address from list maintained in the file. A user will not easily be able to identify address is different until he confirms it manually again.<\/p>\n

Before looking into the working of the Trojan, we need to know what the clipboard is. Clipboard is a shared memory area that you can copy data into and copy data from. All applications have access to this clipboard, data can be easily transferred between applications. Clipboard is used by Windows while cutting, copying, or pasting data. Clipboard is supported with a set of functions that enable applications to transfer or exchange data. Windows provides APIs for managing clipboard.<\/p>\n

GetClipboardData is used to fetch the current (copied) data on clipboard and<\/p>\n

SetClipboardData is used for saving data on the clipboard (I.e. generally when Ctrl+C is pressed).<\/p>\n

Analysis:<\/strong><\/p>\n

Trojan \u2018Trojan.CBHAgent\u2019 is using these Windows API\u2019s to manipulate the clipboard data.<\/p>\n

\"\"
Fig. 1 – Clipboard APIs present in the file.<\/figcaption><\/figure>\n

It is a dropped DLL on victims system that will be run using rundll32.exe, a DLL host, with below command line.<\/p>\n

$> C:\\WINDOWS\\system32\\rundll32.exe “C:\\Documents and Settings\\Administrator\\Desktop\\Sample\\CBHAgent.dll”,includes_func_runnded<\/i><\/em><\/p>\n

Here \u2018includes_func_runnded\u2019 is an exported function which performs the clipboard monitoring. Also, for preventing its analysis, the author checked whether it is being run in virtual machine or not. Trojan is also exported \u2018detection_VMx\u2019 function to use it as anti-VM check.<\/p>\n

Looking at its file structure, it is found that the Trojan sample is packed with PECompact packer to make analysis more difficult. List of bitcoin addresses which are to be\u00a0pasted, are present in resource of file as plain text. More than 2.3 million bitcoin addresses are listed out in the file. All these addresses are sorted so that it would help while searching the target bitcoin address.<\/p>\n

This resulted the file size to 80 MB.<\/p>\n

\"\"
Fig. 2 Bitcoin addresses present in plain text format.<\/figcaption><\/figure>\n

On execution, it starts monitoring clipboard data continuously and checks if there is any like bitcoin address. For validation, it uses regular expression. Once matched, it will be replaced\u00a0with\u00a0a address present in the list.\u00a0The Trojan is not affecting any data other than bitcoin addresses.<\/p>\n

\"\"
Fig 3: Regular expression check for Bitoin address in clipboard data.<\/figcaption><\/figure>\n

This malware runs in the background so users are not easily able to identify that system is infected by Trojan.CBHAgent. We strongly recommend you to double check bitcoin address while doing any bitcoin transaction. The trojan also ensures its persistence in the system by creating a copy in %TEMP% directory and adding its\u00a0run entry in registry. It creates a mutex with name as \u2018MODULE_DXDIAG_1\u2019.<\/p>\n

Quick Heal detects the Trojan as \u2018Trojan.CBHAgent.S3076164\u2019.<\/p>\n

I<\/b><\/strong>ndicator of <\/b><\/strong>compromise<\/b><\/strong>:<\/b><\/strong><\/p>\n

48b66dd02a336eb049a784b3fd1beb5312fb8c078b3729d49e92e3e986c98e91<\/p>\n

Conclusion:<\/b><\/strong><\/p>\n

This malware would attract the other malware authors for exploiting clipboard. In recent future, similar attacks can be observed. So, we should always be careful about the activities which are most common in our day to day life. Malware authors are playing with mentality of the human being and making more sophisticated versions of their payload.<\/p>\n

Other preventive measures that should be taken:<\/b><\/strong><\/p>\n

– Always use security software with the latest updates.<\/p>\n

– Whenever possible, manual verification should be done to prevent the big loss.<\/p>\n

– Install third party software as per your need only. Unwanted applications can be a source of malware.<\/p>\n

– Operating system patches are applied on time and installed software are up-to-date.<\/p>\n

– Avoid clicking on links and downloading attachments in emails from unknown sources.<\/p>\n

Subject Matter Experts:<\/strong><\/p>\n

Pandurang Terkar\u00a0| Quick Heal Security Labs<\/p>\n","protected":false},"excerpt":{"rendered":"

How often do you store your important data in files? It\u2019s very common, right? This data may be URLs, topics, personal data like contacts, email-ids, usernames of different portals and sometimes passwords too (though always recommended to not to do so). We very casually copy this data and paste it in respective applications. In the […]<\/p>\n","protected":false},"author":47,"featured_media":86536,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1613,24,5],"tags":[719],"class_list":["post-86531","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptojacking","category-malware","category-security","tag-bitcoin"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86531"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/47"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=86531"}],"version-history":[{"count":13,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86531\/revisions"}],"predecessor-version":[{"id":86551,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86531\/revisions\/86551"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/86536"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=86531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=86531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=86531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}