Welcome Guest ( Log In | Register )

Outline · [ Standard ] · Linear+

 New Kraken botnet easily fools Windows Defender, and steals Crypto wallet data

views
     
TSdaisiesdontdoit92
post Feb 22 2022, 11:47 AM, updated 3y ago

On my way
****
Junior Member
574 posts

Joined: Jan 2020


QUOTE
Microsoft recently made an update to Window Defender Exclusions permission whereby it is no longer possible to view the excluded folders and files without administrator rights. This is a significant change as threat actors would often use this information to deliver malicious payloads inside such excluded directories in order to bypass Defender scans.

However, this may not be able to stop a new botnet called Kraken which was recently discovered by ZeroFox. That's because Kraken simply adds itself as an exclusion instead of trying to look for excluded places to deliver the payload. This is a relatively simple and effective way to bypass Windows Defender scan.

ZeroFox has explained how this works:

During Kraken’s installation phase, it attempts to move itself into %AppData%\Microsoft.

[...]

To stay hidden, Kraken runs the following two commands:

powershell -Command Add-MpPreference -ExclusionPath %APPDATA%\Microsoft

attrib +S +H %APPDATA%\Microsoft\

ZeroFox noted that Kraken is mainly a stealer malware, similar to the recently discovered Microsoft Windows 11 lookalike website. The security firm adds that Kraken's capabilities now include the ability to steal information related to users' cryptocurrency wallets, reminiscent of the recent fake KMSPico Windows activator malware.

ZeroFox writes:

The most recent feature addition is the ability to steal various cryptocurrency wallets from the following locations:

%AppData%\Zcash
%AppData%\Armory
%AppData%\bytecoin
%AppData%\Electrum\wallets
%AppData%\Ethereum\keystore
%AppData%\Exodus\exodus.wallet
%AppData%\Guarda\Local Storage\leveldb
%AppData%\atomic\Local Storage\leveldb
%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb


https://www.neowin.net/news/beware-new-krak...to-wallet-data/

 

Change to:
| Lo-Fi Version
0.0114sec    0.32    5 queries    GZIP Disabled
Time is now: 29th March 2024 - 02:10 AM