One of the channels of the “YouTube” platform is trying to target the crypto community by providing an explanation of a tool that was developed to generate bitcoin keys to steal victims’ money, but it is in fact a “Trojan” that steals the data they are trying to use and installs on their computers.

The channel named “Crypto World” is trying to deceive users by offering a program that is claimed to be able to steal money from the victims’ Bitcoin wallets.

While in reality the actors are trying to download a “Trojan” capable of collecting various data, stealing documents and accessing the camera.

It was completed Discovery And an analysis of the fraudulent campaign by security researcher “hxFrost”, who published the results on Twitter.

Read:Bitcoin touches $24,000 and Ethereum hits $1,700 after announcing the second consecutive decline in US GDP.

This security researcher is constantly looking for scam campaigns that use cryptocurrency as bait.

This time his research leads to a copy of the Trojan Predator, which has been embedded via embedded links in YouTube videos.

Trojan Predator the Thief was first analyzed by French security expert Fumik0 in 2018, and later versions were examined with Kaspersky researchers in March 2019.

This malware was developed in dark markets by Russian hackers, which are mainly targeting small businesses and regular users.

Large companies will quickly confront and isolate the threat before it causes significant damage.

Scam scheme:

The “Crypto World” YouTube channel has about 341 subscribers, and the first videos appeared on the channel ten months ago.

While the number of subscribers is relatively low, the most viewed videos are around 700-800 times.

The video shows the entire process of creating the private keys for a Bitcoin wallet account and the whole process of hacking.

In the description of the video are included links that users can view and download the file from either on Google Drive, Yandex or Mediafire that include the purported program that generates the keys.

Read:Mobidex: A decentralized mobile cryptocurrency exchange

Once clicked, users are directed to the “Crypto World.zip” download page.

The file contains “setup.exe”.

After running it, an executable file “license.exe” will appear and move to the language =templates = temp folder.

Thus, install the “Trojan” which acts as a thief on the host computer.

Finally, the installed malware will connect to the command and control server to download the remaining components of this Trojan.

In the video description it says that the attached software has no viruses.

In order to gain the trust of users, the attached files are placed on well-known global services “Google Drive, Mediafire…” and without any password.

While Google and other host sources scan each of the uploaded files for malware, they can only detect this version of the Trojan with the AV engine.

Trojan owners adapt and constantly change payload to avoid detection

Obfuscation techniques such as: “XOR, Base64, Substitutions, and Stack strings” are also used.

In general, this malware uses relatively old techniques to remain undetected, but it is effective.

According to Kaspersky research, this Trojan can steal various data and information from you

Read:Ethereum Classic is threatened with a 51% attack… for these reasons

Battle.net, Skype, Pidgin and NordVPN data.

In addition, this Trojan can access and record videos on a webcam, steal documents, and copy clipboard.

Preventive measures:

Information-stealing Trojans are dangerous programs that may lead to the loss of money and personal data.

In the worst case, users may have to deal with the effects of identity theft.

It is therefore advisable to stay away from shady links that promote hacking tools, as these programs often contain malware that can seriously damage the computer or endanger the privacy and safety of users.

In fact, this is not the first time that links in YouTube video descriptions have been used to reproduce malware.

To avoid infecting dangerous malware too, users should stay away from videos that promise freebies especially those made through illegal means and download software only from trusted sources.

Read also:

Beware… Phishing Attacks Targeting BitMEX Leaked Email Addresses

Beware … a fraudulent project claims to be linked to the “Cardano” project