BitCoin

Quote: Tanko

New coins are dropping every day

https://coinmarketcap.com/new/
link to original post

Quote:

Microsoft Incident Response has identified a new remote access trojan (RAT) that is capable of stealing a wide variety of information from your computer from passwords and cryptocurrency wallet information to operating system details, device identifiers, and even camera presence data.

The most sophisticated – and perhaps the most alarming – feature of this new malware is its ability to use watchdog threads to ensure self-reinstatement if removed. Basically, it can reinstall itself.

As reported by BleepingComptuer, the StilachiRAT is used to steal digital wallet data from multiple cryptocurrency wallets including Coinbase Wallet, Phantom, Trust Wallet, Metamask, OKX Wallet, Bitget Wallet and up to 20 others.

The malware also has sophisticated reconnaissance abilities and is able to steal information from an infected PC including credentials stored in your browser, clipboard data, system information, hardware identifiers, camera presence, active Remote Desktop Protocol (RDP) sessions, and running GUI-based applications.

StilachiRAT can extract credentials from Google Chrome's local state file using Windows APIs, monitor clipboard activity for password information and crypto keys and track active windows or applications. It uses the Windows service control manager (SCM) to maintain persistence and reinstalls it automatically when the malware notices its binaries are no longer active.

t the same time, StilachiRAT can monitor active RDP sessions by impersonating logged in users. It does this by capturing information from foreground windows then cloning security tokens. This allows attackers to move laterally through a victim’s network after the malware has been deployed on RDP servers that usually host admin sessions.

StilachiRAT can also evade detection and has anti-forensics features, such as the ability to clear event logs and check for signs that its running in a sandbox in order to block malware analysis attempts. If its tricked into running in a sandbox, the RAT’s API calls are encoded to slow down further analysis.

Quote: rxwine

Quote:

Microsoft Incident Response has identified a new remote access trojan (RAT) that is capable of stealing a wide variety of information from your computer from passwords and cryptocurrency wallet information to operating system details, device identifiers, and even camera presence data.

The most sophisticated – and perhaps the most alarming – feature of this new malware is its ability to use watchdog threads to ensure self-reinstatement if removed. Basically, it can reinstall itself.

As reported by BleepingComptuer, the StilachiRAT is used to steal digital wallet data from multiple cryptocurrency wallets including Coinbase Wallet, Phantom, Trust Wallet, Metamask, OKX Wallet, Bitget Wallet and up to 20 others.

The malware also has sophisticated reconnaissance abilities and is able to steal information from an infected PC including credentials stored in your browser, clipboard data, system information, hardware identifiers, camera presence, active Remote Desktop Protocol (RDP) sessions, and running GUI-based applications.

StilachiRAT can extract credentials from Google Chrome's local state file using Windows APIs, monitor clipboard activity for password information and crypto keys and track active windows or applications. It uses the Windows service control manager (SCM) to maintain persistence and reinstalls it automatically when the malware notices its binaries are no longer active.

t the same time, StilachiRAT can monitor active RDP sessions by impersonating logged in users. It does this by capturing information from foreground windows then cloning security tokens. This allows attackers to move laterally through a victim’s network after the malware has been deployed on RDP servers that usually host admin sessions.

StilachiRAT can also evade detection and has anti-forensics features, such as the ability to clear event logs and check for signs that its running in a sandbox in order to block malware analysis attempts. If its tricked into running in a sandbox, the RAT’s API calls are encoded to slow down further analysis.

link to original post

Quote: AutomaticMonkey

Microsoft? Windows? Google? Chrome?

I'm sorry, these are unfamiliar terms in my digital life. Literally nothing runs on my machines until I type "sudo" and a really long password.
link to original post

Quote: DRich

Quote: AutomaticMonkey

Microsoft? Windows? Google? Chrome?

I'm sorry, these are unfamiliar terms in my digital life. Literally nothing runs on my machines until I type "sudo" and a really long password.
link to original post

What is "sudo"? I am not familiar with that.
link to original post

Quote: DRich

What is "sudo"? I am not familiar with that.
link to original post

Quote: Dieter

Quote: DRich

Quote: AutomaticMonkey

Microsoft? Windows? Google? Chrome?

I'm sorry, these are unfamiliar terms in my digital life. Literally nothing runs on my machines until I type "sudo" and a really long password.
link to original post

What is "sudo"? I am not familiar with that.
link to original post

sudo is like su. The difference is that sudo executes a specified command ("sudo vi /etc/passwd" maybe), where su opens a shell.
link to original post