Lazarus used ‘KANDYKORN’ malware in attempt to compromise exchange —Elastic

Lazarus Group used a brand new type of malware in an try to compromise a crypto alternate, based on an October 31 report from Elastic Safety Labs.

Elastic has named the brand new malware “KANDYKORN” and the loader program that hundreds it into reminiscence “SUGARLOAD,” because the loader file has a novel “.sld” extension in its title. Elastic didn’t title the alternate that was focused.

Crypto exchanges have suffered a rash of private-key hacks in 2023, most of which have been traced to the North Korean cybercrime enterprise, Lazarus Group.

In response to Elastic, the assault started when Lazarus members posed as blockchain engineers and focused engineers from the unnamed crypto alternate. The attackers made contact on Discord, claiming they’d designed a worthwhile arbitrage bot that would revenue from discrepancies between costs of cryptos on completely different exchanges.

The attackers satisfied the engineers to obtain this “bot.” The recordsdata in this system’s ZIP folder had disguised names like “config.py” and “pricetable.py” that made it look like an arbitrage bot.

As soon as the engineers ran this system, it executed a “Predominant.py” file that ran some strange packages in addition to a malicious file known as “Watcher.py.” Watcher.py established a connection to a distant Google Drive account and started downloading content material from it to a different file named testSpeed.py. The trojan horse then ran testSpeed.py a single time earlier than deleting it with the intention to cowl its tracks.

Throughout the single-time execution of testSpeed.py, this system downloaded extra content material and finally executed a file that Elastic calls “SUGARLOADER.” This file was obfuscated utilizing a “binary packer,” Elastic said, permitting it to bypass most malware detection packages. Nevertheless, they have been in a position to uncover it by forcing this system to cease after its initialization capabilities had been known as, then snapshotting the method’ digital reminiscence.

In response to Elastic, they ran VirusTotal malware detection on SUGARLOADER, and the detector declared that the file was not malicious.

Associated: Crypto companies beware: Lazarus’ new malware can now bypass detection

As soon as SUGARLOADER was downloaded into the pc, it linked to a distant server and downloaded KANDYKORN immediately into the machine’s reminiscence. KANDYKORN comprises quite a few capabilities that can be utilized by the distant server to carry out numerous malicious actions. For instance, the command “0xD3” can be utilized to checklist the contents of a listing on the sufferer’s pc, and “resp_file_down” can be utilized to switch any of the sufferer’s recordsdata to the attacker’s pc.

Elastic believes that the assault occurred in April, 2023. It claims that this system might be nonetheless getting used to carry out assaults at present, stating:

“This risk remains to be lively and the instruments and strategies are being repeatedly developed.”

Centralized crypto exchanges and apps suffered a rash of assaults in 2023. Alphapo, CoinsPaid, Atomic Pockets, Coinex, Stake and others have been victims of those assaults, most of which appear to have concerned the attacker stealing a non-public key off the sufferer’s machine and utilizing it to switch prospects’ cryptocurrency to the attacker’s handle.

The US Federal Bureau of Investigation (FBI) has accused the Lazarus Group of being behind the Coinex hack, in addition to performing the Stake assault and others.