Malware
CoinThief
CoinThief was a malware package designed to steal Bitcoins from the victim, consisting of a binary patcher, browser extensions, and a backdoor component.
CoinThief is a macOS malware family.
Background
CoinThief was a Bitcoin-stealing malware bundle made up of a binary patcher, browser extensions, and a backdoor component.
In early 2014 it circulated through several channels:
- on Github, where the trojanized compiled binary did not correspond to the displayed source code,
- on well-known, trusted download portals such as CNET's Download.com and MacUpdate.com, and
- as cracked applications distributed via torrents under the guise of Bitcoin Ticker TTM, BitVanity, StealthBit, Litecoin Ticker, BBEdit, Pixelmator, Angry Birds and Delicious Library.
The patcher's job was to find and tamper with genuine copies of the Bitcoin-Qt wallet application. The samples analyzed targeted Bitcoin-Qt versions 0.8.1, 0.8.0 and 0.8.5. The earlier patch inserted malicious code into Bitcoin-Qt that would route almost all of the victim's Bitcoins to one of the attacker's hard-coded addresses.
The browser extensions, which targeted Chrome and Firefox, posed as a "Pop-up blocker." They watched the sites the user visited, downloaded malicious JavaScript, and injected it into various Bitcoin-related sites, mainly exchanges and online wallet services. The injected scripts could rewrite transactions to divert Bitcoin transfers to an attacker's address or simply scrape login credentials for the targeted service.
The backdoor handed the attacker full control of the victim's machine, allowing them to:
- gather information about the infected computer
- run arbitrary shell scripts on the host
- exfiltrate any file from the victim's drive to a remote server
- update itself to a newer release
Source: Malpedia (Fraunhofer FKIE).