A cryptocurrency-stealing malware is being distributed over Telegram to cybercriminals in the form of free malicious applications.
The malware has been named as HackBoss by the researchers who states that its operators likely stole more than $500,000 from aspiring hackers that fell for the trick.
HackBoss is not sophisticated but the scheme is effective as it tempts victims with the prospect of getting hacking tools, mostly for brute-forcing passwords for banking, dating, and social media accounts.
The security researchers at Avast who has analyzed HackBoss stated that it has been packed in a .ZIP file with an executable that launches a simple user interface.
The UI’s sole purpose is to add the decrypt and execute the cryptocurrency-stealing malware on the victim’s system.
This happens while clicking any button in the fake interface. The action can also give HackBoss persistence on the system by setting up a registry key to run it at startup or by adding a scheduled task that runs the payload every minute.
The malicious payload keeps running on the victim’s computer even after the application’s UI is closed. If the malicious process is terminated, then it can get triggered again on startup or by the scheduled task in the next minute.
The malware has been designed to simply check the clipboard for a cryptocurrency wallet and replace it with one belonging to the attacker.
When the victim initiates a cryptocurrency payment and copies the recipient’s wallet, HackBoss quickly replaces it, taking advantage of the fact that few users check the string before hitting the pay button.
Even though the functions are simple, it needs some effort to maintain the cover of a hacking tool as each post comes with a bogus description to make it a believable offer.
The Avast researchers said that they found over 100 cryptocurrency wallet addresses associated with the HackBoss operation that received more than $560,000 since November 2018.
Not all the funds came from the cryptocurrency-stealing malware though as there some of the addresses have been reported in scams that tricked victims into buying fake software.
Data from the Telemetrio service for Telegram and chat statistics shows that the Hack Boss channel has about nine posts per month, each with more than 1,300 views and over 2,800 subscribers.
The HackBoss authors also promote their fake hacking tools outside the Telegram channel, although this remains the main distribution path.
One avenue is a blog (cranhan.blogspot[.]com) that advertises fake tools, provides promo videos, and also posts ads on public forums and discussions.
Avast provided a long list of indicators of compromise on its GitHub page with hashes and names of the fake applications disguising HackBoss malware and the cryptocurrency wallet addresses (Bitcoin, Ethereum, Litecoin, Monero, Dogecoin)