FatalRAT’s New Prey: Cryptocurrency Users in the Crosshairs

Key Takeaways

• Cyble Research and Intelligence Labs (CRIL) has uncovered a novel phishing campaign tailored to cryptocurrency users.
• This campaign was deploying a well-known FatalRAT along with additional malware such as Clipper and Keylogger.
• The Threat Actors (TAs) orchestrating this campaign employ the DLL side-loading technique to load and execute FatalRAT, Clipper, and Keylogger modules.
• FatalRAT is a Remote Access Trojan that provides attackers with control over the victim’s computer and is equipped with extensive capabilities for stealing sensitive information.
• The inclusion of a clipper module alongside FatalRAT suggests a targeted strategy aimed at cryptocurrency users, and the addition of a keylogger module enhances data interception capabilities.
• The TAs behind this campaign are targeting Chinese-speaking individuals or organizations, as evidenced by using Chinese-language installers.

Overview

CRIL has recently uncovered a sophisticated phishing campaign that specifically targets cryptocurrency users, with a notable emphasis on users of the Exodus platform. In this intricate scheme, threat actors (TAs) have employed a deceptive website meticulously designed to mimic legitimate cryptocurrency applications.

The deceptive site, resembling the interface of the Exodus crypto wallet, aims to lure unsuspecting users into divulging their sensitive information. Exodus offers users the ability to manage their cryptocurrency holdings and conduct transactions. Available as both a desktop application and a mobile app.

The image below shows the deceptive phishing site, mimicking the authentic application interface.

Figure 1 – Phishing site

Once unsuspecting users are lured into downloading the software disguised as genuine Exodus installers from the phishing site, they inadvertently install a Remote Access Trojan known as FatalRAT. Additionally, this installer also deploys other malicious components, such as Clipper and Keylogger, marking a new development compared to previous campaigns.

The TAs have executed a multi-staged attack incorporating multiple components packaged within a single installer file, culminating in the installation of the FatalRAT malware, a clipper, and a keylogger. Notably, the TAs have employed DLL side-loading techniques as part of their strategy to evade detection, a method that has been observed in previous campaigns as well. The image below shows the infection chain observed in the current campaign.

Figure 2 – Infection chain

Upon installation on a victim’s system, the Trojanized Exodus crypto-wallet installer application grants the attackers unauthorized access and control, enabling them to steal sensitive information from web browsers, capturing keystrokes, data manipulation—particularly concerning wallet addresses in the clipboard—and other malicious activities, all concealed from users in the background.

This operation is further enhanced by launching the Exodus installation in the foreground, tactically employing it as a diversion to mislead and distract users, as illustrated in the accompanying figure.

Figure 3 – Displaying the Exodus application in the victim’s machine

Technical Analysis

Upon execution of the downloaded malicious installer (.msi), it drops numerous files into two distinct directories within the C:ProgramData folder, named MoCo and Mo. The image below displays all the files along with their respective folder names.

Figure 4 – Extracted files from the installer

All files listed are components of a multi-staged attack primarily utilizing the DLL side-loading method to execute the final payloads aimed at evading detection by security software. The attack chain unfolds as follows:

• A legitimate executable, thelp.exe (Browser Support Module), is launched by the installer. Following this, thelp.exe utilizes DLL sideloading to load a malicious DLL file named “XLFSIO.dll,” which subsequently loads the loader module named “mt.dll” during runtime, as depicted in the figure below.

Figure 5 – Malicious files used for DLL Sideloading

• The file mt.dll is responsible for launching and executing two additional files named “Mi.JPG” and “BMi.jpg.” However, instead of images, these files contain a shellcode along with an embedded DLL, as shown below.

Figure 6 – Loader file containing the Shellcode filenames

• This shellcode’s objective is to load and execute the embedded DLL in memory by invoking an export function named SignalChromeElf.
• SignalChromeElf function performs decryption, loading, and execution of an encrypted payload present within the embedded DLL. This encrypted payload corresponds to the FatalRAT malware.

Similarly, other components such as Clipper and Keylogger are also observed being loaded into memory using similar methods.

Fatal RAT

FatalRAT is a Remote Access Trojan endowed with a broad spectrum of capabilities, allowing remote execution by an attacker. Initially detected in August 2021, the FatalRAT malware possesses capabilities including keystroke logging, screen resolution manipulation, downloading and executing files, as well as stealing data stored within web browsers.

Before commencing its infiltration procedures, the malware meticulously conducts a series of evaluations. These checks encompass assessments for virtual machine environments, processor types, and active processes, among other factors. Once successfully passing these checks, FatalRAT proceeds to decrypt configuration strings containing the Command and Control (C&C) server address as shown in the image below. Subsequently, any pilfered information is swiftly transmitted to the designated C&C server.

Figure 7 – FatalRAT Configuration strings

Based on our analysis, we’ve concluded that the version of FatalRAT employed in this campaign closely resembles the variant previously identified by AT&T and ESET. In this analysis, we will dive deeper into the Clipper and the keylogger modules.

Clipper

When thelp.exe is executed, it concurrently initiates the execution of the “BMi.jpg” file directly into memory through the utilization of the DLL “mt.dll.”

The file “BMi.jpg” contains a shellcode along with an embedded DLL (like FatalRAT), which is identified as Clipper. This shellcode is designed to load and execute the embedded DLL in memory by invoking DllEntryPoint(), as shown in the figure below.

Figure 8 – Shellcode content with Clipper DLL

After the Clipper content is executed in memory, it utilizes API functions associated with the Windows Clipboard, as depicted in the figure below, to carry out its Clipper activities.

Figure 9 – Clipper functions

The table below shows the details of targeted cryptocurrencies and their regular expressions.

Crypto currencies	Regular Expression	TAs Crypto wallet address
BTC (Bitcoin)	^(1|3|bc1|tb1)[a-zA-Z0-9]{25,61}$	3CRsnPAe1NkhMDaxYNvm61s8DKh79WrwDL
ETH (Ethereum)	^0x[a-fA-F0-9]{40}$	0x5C4b06FcfA8c3417E6F6248c32101a8Abd7936eE

The aforementioned Clipper malware performs the following activities:

• The malware continuously monitors clipboard activity by calling OpenClipboard() to gain access to the clipboard.
• Once the clipboard is open, it uses GetClipBoardData() to retrieve the content stored in the clipboard.
• It then checks if the clipboard content matches any cryptocurrency address patterns defined by the regular expressions mentioned in the above table.
• If a cryptocurrency address is matched, the malware replaces it with a pre-defined malicious wallet address controlled by the Threat Actor.
• After modifying the clipboard content, the malware uses SetClipBoardData() to update the clipboard with the manipulated data, which now contains the TA’s wallet address instead of the original one.
• When the user attempts to paste the cryptocurrency address into a transaction field, they unknowingly paste the TA’s address instead, resulting in the redirection of funds to the attacker’s wallet.

The figure below shows the code snippet used to perform the malicious Clipper activity.

Figure 10 – Code snippet of Clipper’s functionalities

The figure below illustrates the presence of Clipper malware strings within the memory of the “thelp.exe” file.

Figure 11 – Presence of Clipper strings in the memory of thelp.exe

Keylogger Module

In this campaign, we have observed that TAs have placed the keylogger module in an additional directory (C:ProgramDataMo) intended to log all keystrokes and system events. Although the FatalRAT malware already encompasses the keylogging function, this module operates independently without requiring direct intervention from the attacker.

Upon execution of the Trys.exe file, it employs DLL sideloading to dynamically load the “ty.dll” file. Subsequently, this action starts the execution of the “M.jpg” shellcode, which in turn executes the embedded Keylogger module within the memory, as shown below.

Figure 12 – Presence of M.JPG shellcode filename in ty.dll

The following figure illustrates the presence of keylogger module strings within the memory of the “Trys.exe” process.

Figure 13 – Presence of Keylogger strings in the memory of Trys.exe

Prior to initiating the keylogger functions, the malware attempts to identify virtual environments by checking VMware-related processes, paths, and other indicators. If such a virtual environment is detected, the code exits without executing further actions, as shown in the figure below.

Figure 14 – Anti-Vm methods

After that, the malware proceeds to capture keystrokes and system events on the victim’s system. It then saves this information with the filename “sys.key” in the %programdata% folder. The following image depicts the data recorded by the keylogger malware.

Figure 15 – Saved Keylogger file

Within the keylogger, the remote server’s name is encoded in reverse, as shown in the figure below. During runtime, it retrieves the exact domain name from the reversed string and establishes a connection to it for data exfiltration.

• 1-27.qq-weixin[.]org

Figure 16 – Hardcoded server name in reverse order

Attribution

It’s plausible that the group responsible for the previous campaign may be behind this recent attack. This speculation is based on similarities such as the infection chain, file names, and an error observed in the scheduled tasks created. Additionally, the targeting of Chinese individuals, evident Chinese language versions of software used, and the C&C server pattern look similar.

Conclusion

The increasing popularity of cryptocurrency has attracted the interest of this group, leading them to transition from creating fake websites mimicking popular applications to targeting crypto users directly. Given the behavior of this campaign, we can safely conclude that the primary targets of this campaign are cryptocurrency users.

With the incorporation of a potent blend of the RAT (Remote Access Trojan) and a dedicated clipper module, the attackers can seamlessly extract sensitive information from their victims. Clipper malware poses a notable danger to individuals engaged in cryptocurrency activities, as it specifically focuses on intercepting their transactions and redirecting funds to the wallets of TAs. In light of these threats, crypto users must remain vigilant and proactive against such attacks.

Recommendations

• Before accessing or downloading from any site, it is essential to diligently verify the URLs.
• Crypto users should carefully check their wallet addresses before making any cryptocurrency transaction to ensure there is no change when copying and pasting the actual wallet addresses.
• The seeds for wallets should be stored safely and encrypted on any device.
• Before submitting the cryptocurrency wallet information, verify the authenticity source.
• Use strong passwords and enforce multi-factor authentication wherever possible.
• Keep a close eye on your cryptocurrency accounts for any unauthorized activity or suspicious transactions.
• Review and update advertising policies on major platforms like Google and social media networks to prevent the dissemination of malicious ads promoting cryptocurrency scams.

MITRE ATT&CK® Techniques

Tactic	Technique ID	Technique Name
Initial Access (TA0027)	Phishing (T1660)	Malware distribution via phishing site
Execution  (TA0002)	User Execution (T1204)	The user needs to manually execute the file downloaded from the phishing site.
Defense  Evasion  (TA0005)	Masquerading (T1036.008)	Downloads file disguised as a legitimate application.
Defense Evasion (TA0005)	Hijack Execution Flow: DLL Side-Loading (T1574.002)	Malware uses DLL sideloading for payload execution
Defense Evasion (TA0005)	Disable or Modify Tools (T1562.001)	Uses taskkill to terminate processes
Collection  (TA0009)	Clipboard Data  (T1115)	Monitors clipboard data and replaces crypto addresses with their address.
Exfiltration (TA0036)	Exfiltration Over C2 Channel (T1646)	Sending exfiltrated data over C&C server
Impact (TA0040)	Financial Theft (T1657)	Swaps crypto address to transfer funds to TA’s crypto address.

Indicators of Compromise (IOCs)

Indicators	Indicator  Type	Description
hxxps://exodue[.]com	URL	Phishing Site
f80f8a725028bcc09639f7b1ff9439436d974f0bf92871048092eaec5d7458f0	SHA256	Downloaded malicious installer
d56471adbfd095d1be1d4b8288d14283efbf6414912064a97423751a69c1427f	SHA256	BMi.jpg (Clipper)
715138e6cb30bd18cc6afad6322e35f6f1a3d40ac135a1a9bc76cb884508c686	SHA256	M.jpg (Keylogger)
8b0fde6e42ba17b0b475bb8dd54b8554cc6682d81b9e632f8890daa9ceefd48d	SHA256	Mi.jpg (FatalRAT)
a5ca7b8af70d6e483007c6c9c60b0a2002e150b0f479744989fdd58ad2fc62d3	SHA256	malicious installer
03e8610b95753eee43179b1ccc3fb72c8595a7d76e9b0290ea765f8e6372d4f9	SHA256	malicious installer
0555ba582ffdb07a3e93a4d936d2d0d2bd506040f12e5b55e042e82d4bc169ad	SHA256	malicious installer
fba1b353b063a068bd8a191ce699d335158028a6c94282a27f86b784cd4e94e5	SHA256	malicious installer
b3c47e48facfb1d6e4f93b1e9b91c1a931f5e491c5ab4aa0fc5c10ed077674b4	SHA256	malicious installer
149271557eec7f5b17cd046d1f9936dca1654be1edd7835f005fbba145d65b8c	SHA256	malicious installer
1b6ab4d69332a041109c9a8b7bc1d12dd28566a0614363f7887d9044e4345a2e	SHA256	malicious installer
e1368e893c44b29acfe7e9e190bbe448deda18d1847ed697b01c17a373207053	SHA256	malicious installer
efc27a42e520918f83b041f81975e8dbca9916d159dfc41380112c20b43bcd39	SHA256	malicious installer
c03a524b4e0561141012a6dc17f09bc8d0bf772cf2c94731971a50d67dccb2f4	SHA256	malicious installer
47835bbb98d4660ffa225000797e22c3cfd48ae43af8ccf0999a760b8c3a92ba	SHA256	malicious installer
1-27[.]qq-weixin[.]org	Domain	C&C
38[.]181[.]70[.]178	IP	C&C
1-31.qq-weixin[.]org	Domain	Sibling Domains
1-8.qq-weixin[.]org	Domain	Sibling domains

Yara Rule

rule FatalRAT

{
meta:

            author = “Cyble Research and Intelligence Labs”

            description = “Detects FatalRAT dll files”

            date = “2024-04-10”

            os = “Windows”

            hash = “69cbdb401d6c03f3d64b3bf48d527cb4bf507952f34b170a3d020707fc4ff7be”

strings:

            $a1  = “SVP7” ascii nocase

            $a2  = “SVP7-Thread running” ascii nocase”

            $a3  = “DisableLockWorkstation” ascii nocase

condition:

            uint16(0) == 0x5a4d and all of them

}

The post FatalRAT’s New Prey: Cryptocurrency Users in the Crosshairs appeared first on Cyble.