Security researchers have discovered a new strain of malware named ‘SteelFox’ is actively used by threat actors to mine cryptocurrency and steal credit card data. It came to the limelight by August 2024. However, it is believed to be in landscape since February 2023.
The malware spreads as a crack tool that activates legitimate versions of various software such as AutoCAD, Foxit PDF Editor, or JetBrains and leverages the BYOVD8 technique to obtain SYSTEM privileged on Windows machines.
The malware dropper comes with full instructions on how to activate the software and it requires administrator access, which the malware employs later in the attack because the software that is being illegally activated is usually installed in the Program Files.
After securing admin rights, the malicious function affects the code and unpacks the malware. SteelFox creates a service that runs WinRing0.sys inside, a driver vulnerable to CVE-2020-14979 and CVE-2021-41285, and that the malware uses to obtain privilege escalation to NT/SYSTEM level.
WinRing0.sys driver is also used for mining cryptocurrency, as it is part of the XMRig program, modified version of this miner executable that connects to a mining pool with hardcoded credentials to mine Monero cryptocurrency.
The malware then uses TLS v1.3 and SSL pinning to connect to its C2 server, preventing communication from being intercepted. Besides this, it also activates the info-stealer component that extracts data from 13 web browsers, information about the system, network, and RDP connection.
Even if SteelFox attacks do not have specific targets, it appears to focus on users of AutoCAD, JetBrains, and Foxit PDF Editor. From the data we have so far, it appears that the malware was used to compromise systems in Brazil, China, Russia, Mexico, India, Algeria, the UAE, Egypt, Vietnam and Sri Lanka.
Researchers also noted that SteelFox collects data such as credit card data, browsing history, and cookies from browsers. The researchers claim that despite SteelFox’s recent inception, ‘it is a full-featured crimeware bundle’.
For more information, refer to Kaspersky blog
Indicators of Compromise
- hxxps://github[.]com/TrungGa123/Active-all-app-Jetbrains/
- hxxps://github[.]com/tranquanghuy-09/activate-intellij-idea-ultimate/
- hxxps://github[.]com/TaronSargsyan123/ScaraSimulation
- hxxps://raw.githubusercontent[.]com/tranquanghuy-09/activate-intellij-idea-ultimate/main/jetbrains-activator.exe
- hxxps://raw.githubusercontent[.]com/TaronSargsyan123/ScaraSimulation/main/jetbrains-activator.exe
- hxxps://raw.githubusercontent[.]com/TrungGa123/Active-all-app-Jetbrains/main/jetbrains-activator.exe
- hxxps://raw.githubusercontent[.]com/DavidNguyen67/CrackJetbrains/main/jetbrains-activator.exe
- hxxps://www.cloudstaymoon[.]com/2024/05/06/tools-1
- hxxps://squarecircle[.]ru/Intelij/jetbrains-activator.exe
- hxxps://drive.google[.]com/file/d/1bhDBVMywFg2551oMmPO3_5VaeYnj7pe5/view?usp=sharing
- hxxps://github[.]com/cppdev-123
- fb94950342360aa1656805f6dc23a1a0
- 5029b1db994cd17f2669e73ce0a0b71a
- 69a74c90d0298d2db34b48fa6c51e77d
- 015595d7f868e249bbc1914be26ae81f
- 0947cca1b5509f1363da20a0a3640700
- 040dede78bc1999ea62d1d044ea5e763
- 0ce3775fbfbe8f96e769822538c9804c
- 051269b1573f72a2355867a65979b485
- 0f2f104dcc4a6c7e3c258857745d70fb
- 08fa6ebc263001658473f6a968d8785b
- 11caf769c0fb642bbb3daa63e516ca54
- d5290ba0cd8529032849ae567faba1ce
- e7c4e02e1da5afb56a2df0996784a9d5
- d715507131bbf4ca1fe7bc4a5ddfeb19
- e9a14ae0f7eb81346eac9d039138a7d8
- dc8c18e4b729fdbf746252b2fc1decc5
- f3690f597c725553b8ced0179f4f032e
- dc9d42902bda8d63e5858b2a062aecc1
- f8f6c7d65b28b978e4f2a40158973a0c
- c20e1226782abdb120e814ee592bff1a
- c6e7c8c76c7fb05776a0b64699cdf6e7
