OpcJacker

In the latest (February 2023) campaign involving OpcJacker, the infection chain began with malvertisements that were geofenced to users in Iran.

These malvertisements were linked to a malicious website disguised as a website for a legitimate VPN software.

The malware sets up persistence via registry run and task scheduler methods.

The malware is loaded by patching a legitimate DLL library within an installed application, which loads another malicious DLL library.

The patched DLL’s (librawf.dll ... ) import address table was further patched to include two additional DLL libraries.

The malware sets up persistence via registry run and task scheduler methods.

The malware sets up persistence via registry run and task scheduler methods.

Handler ID Function 0x3EB Used for persistence (startup folder)

The malware sets up persistence via registry run and task scheduler methods.

The malware sets up persistence via registry run and task scheduler methods.

Handler ID Function 0x3EB Used for persistence (startup folder)

OpcJacker from chunks of data stored in data files of various formats, such as Waveform Audio File Format (WAV) and Microsoft Compiled HTML Help (CHM).

The first stage shellcode then decrypts and combines all chunks to form the second stage shellcode (a loader) and the main malware.

we observed OpcJacker being distributed through several different campaigns that usually involve fake websites advertising seemingly legitimate software and cryptocurrency-related applications, but are actually hosting malware.

There is a configuration table containing offsets of encrypted chunks... The first stage shellcode then decrypts and combines all chunks to form the second stage shellcode (a loader) and the main malware.

The functions the stealer implements include... detecting virtual machines.

The malicious website checks the client’s IP address to determine whether the victim uses a VPN service. If the IP address is not from a VPN service, it then redirects the victim to the second compromised website... Note that the attack will not proceed if the intended victim is using a VPN service.

The malware is loaded by patching a legitimate DLL library within an installed application, which loads another malicious DLL library.

The patched DLL’s (librawf.dll ... ) import address table was further patched to include two additional DLL libraries.

OpcJacker’s main functions include keylogging...

stealing sensitive data from browsers... 0x641 Steals sensitive data from Chromium

The functions the stealer implements include... detecting virtual machines.

The malicious website checks the client’s IP address to determine whether the victim uses a VPN service. If the IP address is not from a VPN service, it then redirects the victim to the second compromised website... Note that the attack will not proceed if the intended victim is using a VPN service.

OpcJacker’s main functions include keylogging...

OpcJacker’s main functions include keylogging, taking screenshots...

the malware then starts the clipper function, that is, it monitors the clipboard for cryptocurrency addresses and replaces them with its own cryptocurrency addresses controlled by the attackers. | it monitors the clipboard for cryptocurrency addresses and replaces them with its own cryptocurrency addresses controlled by the attackers.

OpcJacker mostly drops (or downloads) and runs additional modules, which are remote access tools — either the NetSupport RAT or a hidden virtual network computing (hVNC) variant.

Finally, the virtual_launch_exe function runs the previously embedded executable, which we observed to be RATs, either the NetSupport RAT, the NetSupport RAT downloader, or hVNC.