{"id":10195,"date":"2017-10-31T08:30:18","date_gmt":"2017-10-31T16:30:18","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/10\/31\/news-3968\/"},"modified":"2017-10-31T08:30:18","modified_gmt":"2017-10-31T16:30:18","slug":"news-3968","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/10\/31\/news-3968\/","title":{"rendered":"CryptoShuffler: Trojan stole $140,000 in Bitcoin"},"content":{"rendered":"

Credit to Author: Marvin the Robot| Date: Tue, 31 Oct 2017 16:19:20 +0000<\/strong><\/p>\n

Imagine that one day you decide to use Bitcoin to pay for, say, a pizza. You copy the wallet address from the pizzeria’s website, enter the required amount, and click the Send button. The transfer goes through, but the pizza doesn’t arrives. The pizzeria owners say they never received the payment. What’s going on? Don’t get mad at the pizza guys \u2014 it’s all down to CryptoShuffler.\"\"<\/a><\/p>\n

Unlike cryptoransomware<\/a>, this Trojan avoids flashy effects, instead doing its best to slip under the radar. It resides quietly in the computer’s memory and monitors the clipboard \u2014 the temporary storage area for cut\/paste operations.<\/p>\n

As soon as CryptoShuffler spots the address of a cryptocurrency wallet on the clipboard (it’s quite easy to distinguish these addresses by line length and specific characters), it replaces the address with another. As a result, the cryptocurrency transfer does indeed go through, and in the amount specified by the payer, only the recipient is not the pizzeria, but the intruders behind CryptoShuffler.<\/p>\n

Having studied the Trojan<\/a>, Kaspersky Lab discovered that the malware targets not only Bitcoin, but also Ethereum, Zcash, Monero, Dash, Dogecoin (yes, it’s real), and other cryptocurrencies as well. Substituting Bitcoin wallets is the Trojan’s most lucrative activity \u2014 at the time of publication the attackers had snagged slightly more than 23 BTC (about $140,000 at the current exchange rate).\"\"<\/a> <\/p>\n

The other cryptocurrency wallets belonging to CryptoShuffler’s creators were found to contain sums ranging from tens to thousands of dollars.<\/p>\n

It took the Trojan a little more than a year to collect that money. Peak activity in late 2016 was followed by a slump, but then in June 2017, CryptoShuffler reawakened.<\/p>\n

This Trojan clearly demonstrates that an infected computer or smartphone will not necessarily slow down or display ransom messages. On the contrary, many kinds of malware try to keep a low profile and to operate as stealthily as possible; the longer they remain undetected, the more money they will make for their creators.<\/p>\n

<\/p>\n

So our advice to all cryptocurrency users is to remain vigilant and get protected. Our products detect CryptoShuffler as Trojan-Banker.Win32.CryptoShuffler.gen, and, needless to say, block all its actions.<\/p>\n

https:\/\/blog.kaspersky.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Marvin the Robot| Date: Tue, 31 Oct 2017 16:19:20 +0000<\/strong><\/p>\n

The CryptoShuffler Trojan does its utmost to go unnoticed, stealing Bitcoins on the sly.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10425,10378],"tags":[10490,14147,16251,10432,1931,10438,12269],"class_list":["post-10195","post","type-post","status-publish","format-standard","hentry","category-kaspersky","category-security","tag-bitcoin","tag-cryptocurrencies","tag-cryptoshuffler","tag-protection","tag-research","tag-threats","tag-trojans"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=10195"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10195\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=10195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=10195"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=10195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}