Connect with us

Hi, what are you looking for?


New BHUNT malware targets your crypto wallets and passwords

ethereum wallet


A novel modular crypto-wallet stealing malware dubbed ‘BHUNT’ has been spotted targeting cryptocurrency wallet contents, passwords, and security phrases.

This is yet another crypto-stealer added to a large pile of malware that targets digital currency, but it is worth special attention due to its stealthiness.

Infection vector

The discovery and analysis of the new BHUNT malware come from Bitdefender, who shared their findings with Bleeping Computer before publishing.

To evade detection and triggering security warnings, BHUNT is packed and heavily encrypted using Themida and VMProtect, two virtual machine packers that hinder reverse-engineering and analysis by researchers.

The threat actors signed the malware executable with a digital signature stolen from Piriform, the makers of CCleaner. However, as the malware developers copied it from an unrelated executable, it’s marked as invalid due to a binary mismatch.

Invalid signature on the main executable
Invalid signature on the main executable
Source: Bitdefender

Bitdefender discovered that BHUNT is injected into explorer.exe and is likely delivered to the compromised system via KMSpico downloads, a popular utility for illegally activating Microsoft products.

KMS (Key Management Services) is a Microsoft license activation system that software pirates frequently abuse to activate Windows and Office products.

BleepingComputer recently reported a similar case of malicious KMSPico activators dropping cryptocurrency-wallet stealers to pirates’ systems.

Advertisement. Scroll to continue reading.

This malware has been detected worldwide, with its greatest concentration of infected users in India, shown in the heat map below.

BHUNT victim heatmap
BHUNT victim heatmap
Source: Bitdefender

BHUNT modules

The main component of BHUNT is ‘mscrlib.exe,’ which extracts further modules that are launched on an infected system to perform different malicious behavior.

BHUNT's execution flow
BHUNT’s execution flow
Source: Bitdefender

Each module is designed for a specific purpose ranging from stealing cryptocurrency wallets to stealing passwords. Using a modular approach, the threat actors can customize BHUNT for different campaigns or easily add new features.

The current modules included in the BHUNT ‘mscrlib.exe’ executable are described below:

  • blackjack – steals wallet file contents, encodes it with base 64, and uploads it to the C2 server
  • chaos_crew – downloads payloads
  • golden7 – steals passwords from the clipboard and uploads the files to the C2 server
  • Sweet_Bonanza – steals information from browsers (Chrome, IE, Firefox, Opera, Safari)
  • mrpropper – cleans up traces (argument files)

The targeted wallets are Exodus, Electrum, Atomic, Jaxx, Ethereum, Bitcoin, and Litecoin.

As you can see in the code snippet below, the blackjack module is used to search for and steal cryptocurrency wallets on a user’s device and send them to a remote server under the attacker’s control.

Blackjack's stealing function
Blackjack’s stealing function
Source: Bitdefender

Once the threat actor gains access to the wallet’s seed or configuration file, they can use it to import the wallet on their own devices and steal the contained cryptocurrency.

Although BHUNT’s focus is clearly financial, its information-stealing capabilities could enable its operators to gather much more than just crypto-wallet data.

“While the malware primarily focuses on stealing information related to cryptocurrency wallets, it can also harvest passwords and cookies stored in browser caches,” – explains Bitdefender’s report.

“This might include account passwords for social media, banking, etc. that might even result in an online identity takeover.”

To avoid being infected by BHUNT, you should simply avoid downloading pirated software, cracks, and illegitimate product activators.

As it’s been proven repeatedly, the projected financial savings from using pirated software are insignificant compared to the damage they can cause to infected systems.

Source link

Advertisement. Scroll to continue reading.

Click to comment

Leave a Reply



We are excited to bring Transform 2022 back in-person July 19 and virtually July 20 – 28. Join AI and data leaders for insightful...

Top Stories

United States Securities and Exchange Commission (SEC) chair Gary Gensler is in talks with Commodity Futures Trading Commission (CFTC) officials on a “memorandum of...

Online Business Success

Business professionals in a meeting presentation discussing company growth getty You’ve got a product the team’s excited about. The group wants to start getting...

Social Media

Are you looking for ways to improve your social media content? Want to add video to your strategy but not sure where to start?...

Top Stories

Sky Mavis, the creator of the play-to-earn game Axie Infinity (AXS), announced that it will reimburse victims of the Ronin bridge hack and reopen...


In context: Intel’s Arc A-series family of discrete GPUs may turn out to be this year’s most underwhelming hardware release. And that’s despite the...


You May Also Like


Introductions get a lot of attention. I’ve explored the topic of how to write them even though as a reader, I always skip them....

Online Business Success

The internet is now our nervous system. We are constantly streaming and buying and watching and liking, our brains locked into the global information...

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Online Business Success

You can think of link building in many ways. I like to call it tedious, painful, and a test of patience. It’s also necessary...