- SHA1: cb4ea311930e1a678efe84b5ccc88d95b36d1466
Description
An Android trojan built into one of the imToken crypto wallet’s modified versions. It steals mnemonic seed phrases used to access crypto wallets and sends them to the attackers’ server. Malware creators distribute this trojan through specially created malicious websites that copy the appearance of imToken project’s genuine website.
A comparison between the genuine website (left) and fake one (right):
Operating routine
The Android.CoinSteal.10 is a full-fledged version of the imToken application with implanted malicious functionality. It looks and operates just like the original safe version. The data theft goes unnoticed by the users.
Upon launch, the trojan displays the app’s main menu. There, the user can either create new crypto wallets or import already existing ones.
In both cases, the user has to enter their seed phrase for authorization into the corresponding field. At that, the seed phrase is covertly sent to the C&C server located at hxxps://api4[.]dealinterface[.]com/api/.
Code fragment responsible for the data hijack:
Code fragment responsible for transferring data to the C&C server:
