Hello world,
Malicious hackers are increasingly turning to exotic malware. But what is that and why?
And a dark web tool which helped cybercriminals figure out how dirty their bitcoin is has
been shut down.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
Malware developers are increasingly turning to ‘exotic’ programming languages in a
bid to evade antivirus software and frustrate malware analysis efforts. This is according
to a new whitepaper from the likes of Blackberry - yes Blackberry still exists. Fun fact, if
you weren’t aware - after Blackberry’s exodus from the mobile device market they’re
now doubling down on cyber security services.
An exotic programming language is one that deviates from what is normally used to develop
malware, ie ditching C, C#, C++ in favour of Go, DLang, Nim or Rust. As Blackberry explains
“Binaries written in these languages can appear more complex, convoluted and tedious
when disassembled”. As such this makes efforts to analyse them more difficult and time consuming.
Switching to more exotic languages also aides in thwarting “signature based detection”,
this kind of detection method looks for patterns of code analogous to already known malware
samples in order to identify new malware, but “When malware is authored in a new language,
as opposed to what has been seen traditionally, signatures written to detect the previous
iteration will more than likely not match.”, hence this makes malware more likely to evade
detection and infect a victim. And when the malware sample eventually lands in the lap
of an analyst, breaking down and understanding the code may be made more difficult.
I should note, after trawling through reddit, I realise there’s some controversy surrounding
what constitutes an exotic programming language - feel free to start a debate in the comments,
but please, don’t shoot the messenger.
One such example of this phenomenon is “ficker stealer”. It’s sold on Russian cybercrime
forums, by one “ficker” - whose profile picture definitely isn’t completely haunting
- if you know what this is a reference to - if it even is - please let me know in the
comments, to me it just looks like an artist's impression of some anthropomorphised gelatinous
potato entity, complete with swimming goggles hmmmm. Anyway, ficker - it’s a “malware
as a service” product - similar to how “ransomware as a service” works, customers pay a subscription
fee to use the Malware on an ongoing basis. Written in Rust for the aforementioned reasons,
it is in essence a login stealer - it targets “credit card information”, “Cryptocurrency
wallets”, and of course saved login credentials on both chrome and firefox - here’s a good
reason to use a password manager.
It can also “act as a downloader to download and execute additional second-stage malware”.
Ficker is often spread via spam email campaigns, armed with a familiar foe we on this channel
seem to encounter on a regular basis “macro-based Excel document attachments”.
Developed with script kiddies in mind, “ficker” provides its customers with a user friendly
dashboard, making it easy to sift through hacked users and examine any data, such as
logins which have been exfiltrated from victims. “Ficker” continues the trend of malware
checking the victim’s keyboard layout - if the victim PC is using the keyboard layout
of an ex-soviet country it won’t infect the victim, and will instead delete itself
- all in an effort to help the developers avoid legal trouble.
This video is sponsored by RoboForm - which aims to level up your security - something
I’m sure you value if you watch these videos. Reusing passwords, or even having strong passwords
but storing them in your browser are both massive nonos. It’s very common for malware
to simply steal passwords stored in browsers like chrome. This is where password managers
come in handy, now I put off using a password manager for the longest time because it looked
like a hassle.
That’s until I tried Roboform. Roboform has been around since 1999, these guys know
what makes a good password manager. It simply sits in your browser, and fills in passwords
when you need them. It’s easy to import logins stored in chrome, firefox, what have
you. It’ll also automatically generate super strong passwords when you sign up to new websites.
Working with Windows, Mac, Linux, iOS and Android - Roboform seamlessly integrates with
all the platforms you use. All your logins are stored behind a cloak of 256 bit AES encryption,
only unlockable via your master key, and of course 2 factor authentication is supported.
Greatly enhance your security today, for the price of a pizza. If you use the link in the
description you’ll get a whole year’s access for $16, that’s little more than
a dollar a month. And in the unlikely scenario you aren’t happy with Roboform they have
a 30 day money back guarantee. It’s a no brainer, roboform, linked in the description.
A dark web tool which helped cybercriminals understand how dirty their bitcoin is has
been shut down. The website, called “antinalysis” was accessible only through the dark web.
It aimed to provide insights as to where your bitcoin originates from, namely if it’s
linked with any illicit activities.
The demand for such a service stems from the risk cybercriminals undertake when they handle
cryptocurrency. Since bitcoin’s blockchain is completely 100% public, it’s feared that
large exchanges like coinbase will perform their own analysis on user’s wallets, flagging
suspicious looking bitcoin to law enforcement agencies - obviously this would be of great
inconvenience to crypto crooks. As such this site enabled people to take it upon themselves,
to analyse their wallets to ascertain their level of risk.
Antinalysis charged roughly $3 for a risk report - breaking down your bitcoin wallet’s
balance into various risk gradings. High risk relates to crypto which has passed through
darkweb markets, been involved in ransomware activity, has been stolen at one point and
so on. Whereas low risk coins are those purchased from exchanges, and newly minted coins from
miners.
Antinalysis addresses the idea of why don’t you “Just cash out in “Monero” and be
done with it.”. XMR or Monero is a privacy focused coin, it’s blockchain is not visible,
so it looks like the perfect choice for criminals to launder money. However they explain “cashing
out in Monero raises eyebrows on exchanges”, “If you use the BTC to Monero then back
to bitcoin method, you’ll still get flagged down by our services labelled as high risk”
I was going to check out Antinalysis first hand, but it’s now been shut down after
receiving some unwanted media attention. The problem is, this site was marketed to... cybercriminals,
surprise, surprise. The website was using the services of a legitimate company AMLBot
to conduct their analysis. AMLBot’s own analysis of wallets looks very similar to
antinalysis - after finding out their API was supposedly being used by criminals, AMLBot
pulled the plug on their API access, effectively rendering the dark web site useless.
It turns out “The creator of Antinalysis is also one of the developers of Incognito
Market”, Incognito is a dark web drugs marketplace - the developer of which, one “Pharoah”
posted a statement, defending their now defunct service by stating “Our team believes, that
in the current democratic world, every one human being has the right to do whatever they
want and possess complete overview of their privacy while not violating individual rights
of others”. Essentially playing the libertarian card, and fair enough - it is a valid argument,
but I don’t think this is going to convince AMLBot to restore their API access.
In the wake of this AMLBot “confirmed that it had reported all relevant addresses that
used Antinalysis to law enforcement.” This could result in the identification of “pharoah”
- or others behind the dark web site.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications. After that, remember to
go check out our sponsor, roboform via the link in the description. If you’re looking
for something to watch next go check out my previous video on why hackers are using morse
code, in 2021.
As always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.