Everything you need to know about microsoft discovers new lightweight backdoor that.
[ad_1]Microsoft says it has detected new self-propagating malware that spreads through USB drives in search of cryptocurrency credentials, which it then sends to attacker-controlled servers.
The company named the worm Crypto Clipper because it monitors the contents of device clipboards for patterns consistent with wallet addresses or seed phrases. When found, the malware also takes five screenshots over a 10-second period. Both the credentials and the screenshots are then sent to the attacker through Tor, a network protocol that provides anonymous routing by sending traffic through redundant nodes so logs can’t capture both the sending and receiving IP addresses. Crypto Clipper establishes the Tor connection by using a SOCKS5 proxy, a network protocol that sends traffic through a proxy server, which then forwards it to its final destination.
A lightweight backdoor
“The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure,” Microsoft said Thursday. “Instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor.”
Microsoft said it observed Crypto Clipper spreading through .lnk file on a USB drive. These files store executable code. When an infected USB drive is plugged into a device, the code checks whether it is already installed on the machine. If it isn’t, the malware downloads it through the Tor proxy. To better conceal evidence of the worm, the malware scans the infected USB drive and names the .lnk files with similar names.
[ad_2]
Source link
More on microsoft discovers new lightweight backdoor that
Stay tuned for updates on microsoft discovers new lightweight backdoor that as the story develops. Related: 10 Best tools for blocking unauthorized USB devices.
Frequently Asked Questions
Microsoft detected new self-propagating malware spreading through USB drives in search of cryptocurrency credentials, which it sends to attacker-controlled servers. The worm monitors clipboards for wallet addresses or seed phrases and takes five screenshots over 10 seconds, sending everything through Tor.
Through .lnk files on USB drives. When an infected drive is plugged in, the code checks if it is installed; if not, it downloads via the Tor proxy. The malware names .lnk files similarly to others on the drive to conceal itself.
It does not depend on a traditional installer or exposed IP-based C2 infrastructure. Instead it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, becoming a lightweight backdoor.
Tor provides anonymous routing by sending traffic through redundant nodes so logs cannot capture both sending and receiving IPs. Crypto Clipper establishes the Tor connection using a SOCKS5 proxy.
