{"id":35752,"date":"2020-06-26T14:34:15","date_gmt":"2020-06-26T14:34:15","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31339\/Glupteba-Malware-Leverages-Blockchain-As-A-Comms-Channel.html"},"modified":"2020-06-26T14:34:15","modified_gmt":"2020-06-26T14:34:15","slug":"glupteba-malware-leverages-blockchain-as-a-comms-channel","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/glupteba-malware-leverages-blockchain-as-a-comms-channel\/","title":{"rendered":"Glupteba Malware Leverages Blockchain As A Comms Channel"},"content":{"rendered":"
<\/div>\n
\n

Glupteba malware does something novel: It uses the bitcoin blockchain as a communications channel to receive updated configuration information.<\/p>\n

That\u2019s important because malware always needs a way to go back to its home base, preferably without being detected, according to a paper<\/a> released this week by Sophos Labs researchers.<\/p>\n

The new form of malware sprinkles some of the old with the new to launch malware that can steal local PII on web browsers and then launch similar attacks from the victim\u2019s home network.<\/p>\n

But even as it blazes a new trail for maneuvering malware in the blockchain world, Glupteba uses one of the oldest tricks in the book: The malware preys on people\u2019s unending desire to get something for nothing.<\/p>\n

Andrew Brandt, a principal researcher at Sophos Labs, explained that Glupteba tends to prey on people who frequent piracy sites looking for popular graphics programs such as Adobe Illustrator.<\/p>\n

\u201cThis is definitely a play for people working from home or people who have their kids at home,\u201d Brandt says. \u201cI don\u2019t know what it is, people must know these sites are bad, but the lure is too strong. Glupteba tends to prey on people who don\u2019t have a lot of money, but need the functionality of these software programs.\u201d<\/p>\n

Brandt would not disclose the damage Glupteba has caused and would not tie these activities to specific threat groups. However, while Sophos researchers don\u2019t have any direct information about why the creators of Glupteba have made this malware, Brandt said a potential motive may be to create a network of machines in which they can sell access \u2013 mainly to other malware groups.<\/p>\n

\u201cWe also know they have a component of their malware that steals passwords and other sensitive data from the infected machine, but we have no information about what they do with that information, and we\u2019d prefer not to speculate whether they use it themselves, sell it onward, or do something else with it,\u201d Brandt added.<\/p>\n

According to a recent Sophos blog,<\/a> while many of Glupteba\u2019s self-protection components mean that it has many tricks available to stop itself showing up in the victim\u2019s security logs, this complexity makes the malware less reliable, and ironically more prone to triggering security alarms at some point.<\/p>\n

\u201cSome of the low-level programming tricks it uses\u2026not only don\u2019t work on recent versions of Windows, but also often draw attention to themselves by the way they misbehave, up to and including crashing your computer with a giveaway blue screen of death,\u201d the blog reported.<\/p>\n

Despite these reassuring points, once Glupteba infects a machine, it has any number of ways to make its way on to networks and has been cleverly designed to evade defenders. Here are the main characteristics of Glupteba as outlined by Sophos Labs:  <\/p>\n