.
DoubleFinger deploys GreetingGhoul and the Remcos Remote Access Trojan (RAT). A code analysis of GreetingGhoul revealed: it is a styler program designed to steal credentials, consisting of two main components that, virus experts tell us, work together. The first component uses MS WebView2 environment to create a fake cryptocurrency wallet interface, and the second component detects the cryptocurrency application on the victim’s device and steals critical sensitive information.
Lab experts note the high risk of infecting user devices because the multi-step shellcode-style loader with steganographic capabilities uses Windows COM interfaces for stealthy execution, as well as Process Doppelgänging implementations to infiltrate remote processes. The program demonstrates a high level of development excellence, Kaspersky representatives say.
In late May, analytics company Scam Sniffer notified the
the cryptocurrency community that malware vendor Inferno Drainer could allegedly be linked to thousands of millions of dollars worth of crypto-assets being stolen.