- SHA1: dd0b699dc01ae6c439cc2273ccd6ad0dae2c6d84
Description
An Android trojan based on the MetaMask open source crypto wallet software. It steals mnemonic seed phrases used to access crypto wallets and sends them to the attackers’ server. Malware creators distribute this trojan through specially created malicious websites that copy the appearance of the MetaMask project’s genuine website.
A comparison between the genuine website (left) and fake one (right):
Operating routine
The Android.CoinSteal.11 is a full-fledged version of the MetaMask application with implanted malicious functionality. It looks and operates just like the original safe version. The data theft goes unnoticed by the users.
Upon launch, the trojan displays the app’s main menu. There, the user can either create new crypto wallets or import already existing ones.
In both cases, the user has to enter their seed phrase for authorization into the corresponding field. At that, the seed phrase is covertly sent to the C&C server located at hxxps://dht[.]tokenpocket[.]pm/api/jkkey.
