Attackers Deploy LeakyInjector and LeakyStealer to Hijack Crypto Wallets and Browser Info

Cybersecurity researchers at Hybrid Analysis have uncovered a sophisticated two-stage malware campaign targeting cryptocurrency wallet users and browser data.

The newly identified malware duo, dubbed LeakyInjector and LeakyStealer, represents a significant threat to digital asset security through its advanced evasion techniques and comprehensive data theft capabilities.

Advanced Injection Techniques Evade Detection

LeakyInjector serves as the initial stage of the attack, employing low-level Windows APIs to inject its payload into the legitimate explorer.exe process.

This injection method helps the malware avoid detection by security software that monitors standard process creation. The injector stores LeakyStealer in an encrypted format using the ChaCha20 algorithm, then decrypts and deploys it to the target system.

Both malware components were signed with valid Extended Validation certificates issued to Hefei Nudan Jukuang Network Technology Co., Ltd., lending them a legitimacy that can bypass initial security checks.     

The malware establishes persistence by copying itself as “MicrosoftEdgeUpdateCore.exe” in the AppData directory and creating a registry entry under the Run key.

This disguise as a Microsoft Edge update component allows the malware to run automatically at system startup without immediately raising suspicion from users.

LeakyStealer demonstrates extensive targeting of cryptocurrency assets, scanning infected systems for popular wallet applications including Electrum, Exodus, Atomic, Sparrow, Ledger Live, Guarda, and BitPay.

The malware extends its reach to browser-based cryptocurrency extensions such as MetaMask, Phantom, Coinbase Wallet, and Trust Wallet, which have become increasingly popular among crypto users.

Beyond cryptocurrency theft, the malware harvests browser history files from Google Chrome, Microsoft Edge, Brave, Opera, and Vivaldi.

This browsing data can reveal financial accounts, trading platforms, and other sensitive information valuable to attackers.

The stolen information is exfiltrated to the command-and-control server at Everstead. The group does so through HTTP POST requests that use browser-related user agents to blend with regular web traffic.

LeakyStealer implements a polymorphic engine that dynamically adjusts its memory footprint using hard-coded byte sequences.

This technique attempts to evade memory-based detection systems that rely on static signatures.

The malware computes a unique Bot ID for each infected machine by XOR-ing the C drive volume serial number with a constant value, enabling attackers to track individual victims.

The stealer includes two backdoor commands allowing remote attackers to download and execute additional files or run Windows commands on compromised systems.

The malware maintains regular communication with its command server, beaconing at intervals to receive instructions and exfiltrate stolen data.

Security researchers identified seven related samples that use the same certificate infrastructure, indicating an active, ongoing campaign targeting cryptocurrency users worldwide.

Indicators of Compromise

SHA256

9b8bd9550e8fdb0ca1482f801121113b364e590349922a3f7936b2a7b6741e82

88e0c1652eb91c517a5fec9d356c7f30c0136d544f5d55ac37f20c5612134efb

Files created

%AppData%\MicrosoftEdgeUpdateCore.exe

C:\Users\<User>\AppData\Local\Temp\history_%d.db

Registry value

EdgeUpdateCore

C2 server

everstead[.]group

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.