mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
ryan
1.6 KiB
1.6 KiB
| ID | B0028 |
| Objective(s) | Collection, Credential Access |
| Related ATT&CK Techniques | None |
| Version | 2.2 |
| Created | 14 August 2020 |
| Last Modified | 5 December 2023 |
Cryptocurrency
Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets.
Methods
| Name | ID | Description |
|---|---|---|
| Bitcoin | B0028.001 | Access Bitcoin data. |
| Ethereum | B0028.002 | Access Ethereum data. |
| Zcash | B0028.003 | Access Zcash data. |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| ElectroRAT | 2020 | -- | ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [1] |
Detection
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| infostealer_bitcoin | Cryptocurrency (B0028) | -- |
| infostealer_bitcoin | Cryptocurrency::Bitcoin (B0028.001) | -- |
References
[1] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/