Cryptocurrency Clicker Gameplay (PC game).
Evrial Trojan can steal what's saved on your Windows Clipboard, including Bitcoins
The recently discovered malware, which is available as a service, also steals passwords and documents and takes screenshots of active windows.
Building a slide deck, pitch, or presentation? Here are the big takeaways:
A newly discovered Trojan kit called Evrial is capable of redirecting cryptocurrency transactions by monitoring the Windows Clipboard for wallet addresses and substituting them with hacker-controlled ones.
Evrial can also steali passwords and cookies from a variety of browsers, copy files, and take screenshots of active windows. It's available as a service and is largely undetected by antivirus engines.
is capable of monitoring the Windows Clipboard, detecting cryptocurrency wallet addresses, and editing them to redirect Bitcoins, Etherium, Litecoins, and more.
for sale on Russian hacking forms for as little as $27 USD and comes as a complete malware-as-a-service (MaaS) package. All the purchaser has to do is access the Evrial web interface to build the Trojan's executable file and harvest information stolen from infected machines.
Once installed on a target Windows machine, Evrial monitors the Clipboard for anything that looks like a cryptocurrency wallet address, and when one is detected it changes it to a wallet controlled by the Trojan's controller instead.
Cryptocurrency wallet addresses are long strings of characters, so when transferring coins from one wallet to another most people simply copy and paste the address. An Evrial-infected machine is pasting that altered address, most likely unnoticed by the victim.
What it does with the original address makes things even worse: It uploads the wallet address that was copied to the Clipboard to its web interface, giving the attacker access to the original wallet as well.
Evrial features, as advertised on a Russian hacking forum (translated).
Evrial is configured to recognize wallet addresses for Bitcoin, Litecoin, Monero, WebMoney Bitcoin Clicker Steam , QIWI, and even the URLs used to trade items on the gaming platform Steam.
Along with monitoring the Clipboard for digital currencies, Evrial also steals locally stored Bitcoin wallets, which it does by looking for wallet.dat files in the infected computer's registry. It can also steal website credentials stored in Chrome, Yandex, Orbitum, Opera, Amigo, Torch, and Comodo web browsers, as well as chat client Pidgin and the Filezilla FTP client.
Evrial also steals cookies and files formatted as doc, docx, txt, and log. It takes screenshots of active windows and uploads all of its stolen information as ZIP files to its web portal, as well.
Evrial is a nasty piece of work capable of stealing most every password and cryptocurrency wallet on a Windows PC. Bitcoin Clicker Steam , Evrial is a nasty piece of work capable of stealing most every password and cryptocurrency wallet on a Windows PC.
Evrial's attack vector isn't currently known and is likely varying from attacker to attacker since the web portal simply produces an EXE and leaves its controller on its own.
eight out of 67 antivirus platforms detecting it, so it's very likely that it's going unnoticed as well.
IT leader's guide to reducing insider security threats
That said, the only way to reliably avoid Evrial at this point is to be vigilant and practice good PC hygiene. Make sure computers you manage are prohibited from installing software without administrator permission, always apply security patches and OS updates, and keep antivirus definitions current.
New threats emerge daily. Know what's coming by subscribing to our Cybersecurity Insider newsletter.
Windows security: Cryptocurrency miner malware is enslaving PCs with EternalBlue
Cryptocurrency apps for Android are a security vulnerability minefield
Android vs iOS vs Windows: Which suffers most infections? Nokia reveals all
Windows 10 Fall Creators Update: Be proactive and turn on ransomware protection
Brandon writes about apps and software for TechRepublic. He's an award-winning feature writer who previously worked as an IT professional and served as an MP in the US Army.
Brandon Vigliarolo has nothing to disclose. He does not hold investments in the technology companies he covers.
Brandon writes about apps and software for TechRepublic. He's an award-winning feature writer who previously worked as an IT professional and served as an MP in the US Army.
Can Russian hackers be stopped? Here's why it might take 20 years
hyperloop Bitcoin Clicker Steam , hyperloop, and drones will change our travel plans
Exomedicine arrives: How labs in space could pave the way for healthcare breakthroughs on Earth Bitcoin Clicker Steam
How Sephora is leveraging AR and AI to transform retail and help customers buy cosmetics
We deliver the top business tech news stories about the companies, the people, and the products revolutionizing the planet.
Our editors highlight the TechRepublic articles, galleries, and videos that you absolutely cannot miss to stay current on the latest IT news, innovations, and tips.
0 Reviews:
Post Your Review