Education

Cryptojacking: Deadly Malware or Minor Annoyance?

What-is-cryptojacking|steal-my-food-from-the-fridg

News

A new type of malware is compromising Metamask and at least 40 other different software crypto wallets.



First analyzed by malware expert <a href="https://twitter.com/3xp0rtblog" target="_blank" rel="noopener">3xp0rt</a>, “Mars Stealer” appears to be an enhanced version of the Oski Stealer malware which surfaced in late 2019. Just 95kb in size, the malware is an information-stealing program that can steal data from any web browser, including popular crypto wallet extensions, before disappearing from the victim’s device.



It also has the ability to grab two-factor authentication (2fa) codes, which many crypto holders rely heavily on to protect their bags.



According to a report from <a href="https://www.bleepingcomputer.com/news/security/powerful-new-oski-variant-mars-stealer-grabbing-2fas-and-crypto/" target="_blank" rel="nofollow noopener">BleepingComputer</a>, Mars Stealer can “exfiltrate files from the infected system and relies on its own loader and wiper, which minimizes the infection footprint.”



So far, the malware is known to be a threat to Google Chrome, Brave Browser, Internet Explorer, Microsoft Edge, and at least 30 other internet browsers and applications. It is also known to circumvent Google Authenticator, Authy, Trezor Password Manager and multiple other 2FA apps.



TronLink, <a href="https://{MIGRATED_DOMAIN}/education/metamask-beginners-guide/">MetaMask</a>, Binance Chain Wallet, Yoroi, Nifty Wallet, Math Wallet, <a href="https://{MIGRATED_DOMAIN}/news/coinbase-acquires-bread-wallet-brd-token-moons-840/">Coinbase Wallet</a>, Guarda, EQUAL Wallet, Jaxx Liberty, and many other crypto extensions are vulnerable to Mars Stealer and crypto wallets like Bitcoin Core, Exodus, Binance and Coinomi are all susceptible to hacks in addition.



<figure class="wp-block-image aligncenter"><img src="https://img.coinbureau.dev/strapi/2022/02/wallets.png" alt=""/><figcaption class="wp-element-caption"><a href="https://3xp0rt.com/posts/mars-stealer#conclusion" target="_blank" rel="nofollow noopener">3xp0rt</a></figcaption></figure>



Mars Stealer is currently available for $140 on Russian-speaking dark markets, making the barrier to entry relatively low.



According to 3xp0rt, the malware also allows attackers to retrieve the following information:



<ul>
<li>IP and country</li>



<li>Working path to EXE file</li>



<li>Local time and time zone</li>



<li>Language system</li>



<li>Language keyboard layout</li>



<li>Notebook or desktop</li>



<li>Processor model</li>



<li>Computer name</li>



<li>User name</li>



<li>Domain computer name</li>



<li>Machine ID</li>



<li>GUID</li>



<li>Installed software and their versions</li>
</ul>



3xp0rt <a href="https://3xp0rt.com/posts/mars-stealer#conclusion" target="_blank" rel="nofollow noopener">said</a>:



<blockquote class="wp-block-quote">
“Mars Stealer it’s an improved version of Oski Stealer. Have been added anti-debug check, crypto extensions stealing, but outlook stealing is missing. The code has been refactoring, but some algorithms remained stupid as in Oski Stealer. Here you can read detailed Oski Stealer analysis from CyberArk.”
</blockquote>



<figure class="wp-block-image"><a href="https://guy.coinbureau.com/signup/" target="_blank" rel="nofollow noopener"><img src="https://img.coinbureau.dev/strapi/2021/09/Newsletter_inline.jpg" alt="Newsletter Inline" class="wp-image-25564"/></a></figure>