Lazarus used ‘KANDYKORN’ malware in try and compromise change —Elastic

Lazarus Group used a brand new type of malware in an try and compromise a crypto change, in line with an October 31 report from Elastic Safety Labs.

Elastic has named the brand new malware “KANDYKORN” and the loader program that hundreds it into reminiscence “SUGARLOAD,” because the loader file has a novel “.sld” extension in its title. Elastic didn’t title the change that was focused.

Crypto exchanges have suffered a rash of private-key hacks in 2023, most of which have been traced to the North Korean cybercrime enterprise, Lazarus Group.

In keeping with Elastic, the assault started when Lazarus members posed as blockchain engineers and focused engineers from the unnamed crypto change. The attackers made contact on Discord, claiming they’d designed a worthwhile arbitrage bot that would revenue from discrepancies between costs of cryptos on totally different exchanges.

The attackers satisfied the engineers to obtain this “bot.” The information in this system’s ZIP folder had disguised names like “config.py” and “pricetable.py” that made it look like an arbitrage bot.

As soon as the engineers ran this system, it executed a “Important.py” file that ran some extraordinary packages in addition to a malicious file known as “Watcher.py.” Watcher.py established a connection to a distant Google Drive account and started downloading content material from it to a different file named testSpeed.py. The computer virus then ran testSpeed.py a single time earlier than deleting it with a purpose to cowl its tracks.

Throughout the single-time execution of testSpeed.py, this system downloaded extra content material and finally executed a file that Elastic calls “SUGARLOADER.” This file was obfuscated utilizing a “binary packer,” Elastic acknowledged, permitting it to bypass most malware detection packages. Nevertheless, they have been capable of uncover it by forcing this system to cease after its initialization features had been known as, then snapshotting the method’ digital reminiscence.

In keeping with Elastic, they ran VirusTotal malware detection on SUGARLOADER, and the detector declared that the file was not malicious.

Associated: Crypto firms beware: Lazarus’ new malware can now bypass detection

As soon as SUGARLOADER was downloaded into the pc, it related to a distant server and downloaded KANDYKORN immediately into the machine’s reminiscence. KANDYKORN accommodates quite a few features that can be utilized by the distant server to carry out numerous malicious actions. For instance, the command “0xD3” can be utilized to listing the contents of a listing on the sufferer’s laptop, and “resp_file_down” can be utilized to switch any of the sufferer’s information to the attacker’s laptop.

Elastic believes that the assault occurred in April, 2023. It claims that this system might be nonetheless getting used to carry out assaults right this moment, stating:

“This risk continues to be energetic and the instruments and strategies are being repeatedly developed.”

Centralized crypto exchanges and apps suffered a rash of assaults in 2023. Alphapo, CoinsPaid, Atomic Pockets, Coinex, Stake and others have been victims of those assaults, most of which appear to have concerned the attacker stealing a personal key off the sufferer’s machine and utilizing it to switch clients’ cryptocurrency to the attacker’s handle.

The US Federal Bureau of Investigation (FBI) has accused the Lazarus Group of being behind the Coinex hack, in addition to performing the Stake attack and others.