Strange happening cutting and pasteing a bitcoin address.

DireWolfM14

copper member

Activity: 2184

Merit: 4238

Join the world-leading crypto sportsbook NOW!

Quote from: sandy-is-fine on December 30, 2020, 12:23:40 PM

Quote from: bob123 on December 30, 2020, 12:19:20 PM

Quote from: sandy-is-fine on December 30, 2020, 12:14:38 PM

Hmmm, I see this thread was moved and I got no notice of it. Anyway, I THINK I found the cause. I run an Oracle Virtualbox WIN10 VM to use as a (LOL) sandbox for questionable items I find in posts on here before I report them as malware or whatever. It seems that is what bit me and I believe I know where/when I got it. Unfortunately (or fortunately) the guy was nuked after I reported his post.

After I reboot, I no longer have the issue but, so far, as soon as I load the VM it returns. That's how it looks at the moment, of course I can easily be proven wrong although I have replicated it about 10x so far. If that is the case it's easy enough to nuke the VM.

So, you had shared clipboard enabled?
If so, this definitely makes sense. If it isn't, nuking the VM does not necessarily mean your problem is solved.

And for the future, you might want to make sure to disable any interfaces such as shared folders, shared clipboard, network interfaces, etc..

And I am quite sure THIS download https://bitcointalk.org/index.php?topic=5305039.new#new or one similar to it is where it came from.
https://archive.vn/wip/lIP97

Head bob123's warning! I use VMs for a variety of things myself, mostly so I can test stuff on Ubuntu and MacOS, and I have those linked to my host PC via shared folders and clipboard, but if you are using a VM for investigating potential malware, make sure to keep that VM isolated.

Deleting that VM might work, but unless you're a wizard with the windows registry and can confirm your host PC hasn't been infected I recommend you nuke the whole system and start from scratch.

sandy-is-fine

legendary

Activity: 1919

Merit: 1230

AKA Ms-overzealous-condecsending-explitive-account

Quote from: NotATether on December 30, 2020, 12:43:25 PM

OK that does it. This is the third instance of someone getting compromised by clipboard malware I read these last two weeks. I'm going to write a Windows utility that nukes anything that replaces a BTC address in the clipboard with another address and use sha1 checksums to whitelist legitimate binaries like browsers and wallets.

PLEASE !!!!

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

OK that does it. This is the third instance of someone getting compromised by clipboard malware I read these last two weeks. I'm going to write a Windows utility that nukes anything that replaces a BTC address in the clipboard with another address and use sha1 checksums to whitelist legitimate binaries like browsers and wallets.

sandy-is-fine

legendary

Activity: 1919

Merit: 1230

AKA Ms-overzealous-condecsending-explitive-account

Quote from: bob123 on December 30, 2020, 12:19:20 PM

Quote from: sandy-is-fine on December 30, 2020, 12:14:38 PM

Hmmm, I see this thread was moved and I got no notice of it. Anyway, I THINK I found the cause. I run an Oracle Virtualbox WIN10 VM to use as a (LOL) sandbox for questionable items I find in posts on here before I report them as malware or whatever. It seems that is what bit me and I believe I know where/when I got it. Unfortunately (or fortunately) the guy was nuked after I reported his post.

After I reboot, I no longer have the issue but, so far, as soon as I load the VM it returns. That's how it looks at the moment, of course I can easily be proven wrong although I have replicated it about 10x so far. If that is the case it's easy enough to nuke the VM.

So, you had shared clipboard enabled?
If so, this definitely makes sense. If it isn't, nuking the VM does not necessarily mean your problem is solved.

And for the future, you might want to make sure to disable any interfaces such as shared folders, shared clipboard, network interfaces, etc..

And I am quite sure THIS download https://bitcointalk.org/index.php?topic=5305039.new#new or one similar to it is where it came from.
https://archive.vn/wip/lIP97

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: sandy-is-fine on December 30, 2020, 12:14:38 PM

Hmmm, I see this thread was moved and I got no notice of it. Anyway, I THINK I found the cause. I run an Oracle Virtualbox WIN10 VM to use as a (LOL) sandbox for questionable items I find in posts on here before I report them as malware or whatever. It seems that is what bit me and I believe I know where/when I got it. Unfortunately (or fortunately) the guy was nuked after I reported his post.

After I reboot, I no longer have the issue but, so far, as soon as I load the VM it returns. That's how it looks at the moment, of course I can easily be proven wrong although I have replicated it about 10x so far. If that is the case it's easy enough to nuke the VM.

So, you had shared clipboard enabled?
If so, this definitely makes sense. If it isn't, nuking the VM does not necessarily mean your problem is solved.

And for the future, you might want to make sure to disable any interfaces such as shared folders, shared clipboard, network interfaces, etc..

sandy-is-fine

legendary

Activity: 1919

Merit: 1230

AKA Ms-overzealous-condecsending-explitive-account

Hmmm, I see this thread was moved and I got no notice of it. Anyway, I THINK I found the cause. I run an Oracle Virtualbox WIN10 VM to use as a (LOL) sandbox for questionable items I find in posts on here before I report them as malware or whatever. It seems that is what bit me and I believe I know where/when I got it. Unfortunately (or fortunately) the guy was nuked after I reported his post.

After I reboot, I no longer have the issue but, so far, as soon as I load the VM it returns. That's how it looks at the moment, of course I can easily be proven wrong although I have replicated it about 10x so far. If that is the case it's easy enough to nuke the VM.

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: sandy-is-fine on December 29, 2020, 11:59:28 PM

No shit. WOW! I've run malwarebytes and norton and it always was clean.

Small corrrection:

Your PC was not compromised with a malware which was known to malwarebytes and norton.
This does not mean that it is/was clean.

AV's only recognize already well known malware or very obvious ones.
It's not that hard to make it undetectable by standard AV engines.

An AV can only confirm that a device is compromised, but not that it is clean.

You should definitely make a backup of your most important files and format your hard drive reinstalling your OS.

LoyceV

legendary

Activity: 3290

Merit: 16489

Thick-Skinned Gang Leader and Golden Feather 2021

Quote from: pooya87 on December 30, 2020, 03:19:12 AM

This may sound far fetched but it is possible that this particular clipboard hijacker is using a vanity address generator under the hood to generate an address that starts with the same couple of characters

That's not far fetched, it's quite likely. Either that, or it has a list of pre-created addresses. Or maybe it connects to a server to fetch a fresh address as needed.

Quote from: pooya87 on December 30, 2020, 05:17:03 AM

Not necessarily. Search can start from a fixed hard-coded key

That would mean you can extract that hard-coded key and recover your funds (and funds of other victims too). Given that the funds haven't moved, it doesn't look like the attacker is in a rush to secure the funds.

I made a topic about this last year: How to lose your Bitcoins with CTRL-C CTRL-V.

pooya87

legendary

Activity: 3444

Merit: 10558

Quote from: ranochigo on December 30, 2020, 04:34:53 AM

That's what I theorized at the start. However, such implementations will inevitably need the private keys to be sent to the C&C which will result in more detection by AVs.

Not necessarily. Search can start from a fixed hard-coded key and only for a small number of characters which means all the produced keys will be very close to that starting key and the attacker has to only watch those keys without needing to send anything over the internet.
For example from "9827eaed4d6ab8c0b78d4b73786a7696491fe8d02f2713a3c9977caf8202387c" (a random key) it only takes 8206 increments to find a key that has an address that starts with "1DBH" (checking both compressed and uncompressed pubs).

ranochigo

legendary

Activity: 2954

Merit: 4158

Quote from: pooya87 on December 30, 2020, 03:19:12 AM

This may sound far fetched but it is possible that this particular clipboard hijacker is using a vanity address generator under the hood to generate an address that starts with the same couple of characters in order to increase its chance of fooling the victim into thinking the pasted address is the same one as copied (if they only check the start):

Code:

1DBHG... (malicious)
1DBHJ... (real)

This could explain why it takes multiple tries to be able to paste the correct address.
If that's the case it could be detected by checking the CPU activity which should spike immediately after an address is copied. It would be a big spike but for a very short time.

That's what I theorized at the start. However, such implementations will inevitably need the private keys to be sent to the C&C which will result in more detection by AVs. From what I observed, most of the stealthy ones will have a list of addresses (a huge list) to choose from. I think the more plausible explanation is for the malware to have a randomized replacement, (ie. to have a malicious address every x tries).

pooya87

legendary

Activity: 3444

Merit: 10558

Quote from: suchmoon on December 30, 2020, 12:38:43 AM

Quote from: sandy-is-fine on December 30, 2020, 12:30:14 AM

Well I figure if I go back into the PM here I got the correct address from and try copy/paste it again and if it works without problem I would hopefully be OK.

That could be misleading. You already noticed it doesn't happen every time. Who knows if the malware doesn't have some logic in it to avoid detection and not replace the same address in certain circumstances. Or if it doesn't have other nasties in it like keyloggers or ransomware. Play it safe and start from scratch.

This may sound far fetched but it is possible that this particular clipboard hijacker is using a vanity address generator under the hood to generate an address that starts with the same couple of characters in order to increase its chance of fooling the victim into thinking the pasted address is the same one as copied (if they only check the start):

Code:

1DBHG... (malicious)
1DBHJ... (real)

This could explain why it takes multiple tries to be able to paste the correct address.
If that's the case it could be detected by checking the CPU activity which should spike immediately after an address is copied. It would be a big spike but for a very short time.

Vod

legendary

Activity: 3668

Merit: 3010

Licking my boob since 1970

Quote from: sandy-is-fine on December 30, 2020, 12:52:22 AM

Although after a reboot there is no problem.

Pay attention to Suchmoon's warning...

sandy-is-fine

legendary

Activity: 1919

Merit: 1230

AKA Ms-overzealous-condecsending-explitive-account

Quote from: Vod on December 30, 2020, 12:46:59 AM

sandy, what OS are you using?

If Windows 10, there are a limited number of registry entries that can do this. If you have 40 years PC experience, you could try cleaning that way.

There is a chance your BIOS could be affected as well, meaning you could reinfect the computer after reinstall. If you don't have a super complicated system, it would be prudent to flash / re-flash the BIOS to the latest version - before you format your hard drive for reinstall.

Latest Win10 update on a MSI motherboard. I guess to be safe I can also reflash the BIOS. Although after a reboot there is no problem.

Edit: Been using AUTORUNS utility and nothing strange is OBVIOUS. Well actually 36 years. NOT highly technical but can get around pretty well. Makes my husband jealous I know more than him.

Goodnight! I've had enough for today. I'll unplug this from the switch.

Thanks everyone!

sandy-is-fine

legendary

Activity: 1919

Merit: 1230

AKA Ms-overzealous-condecsending-explitive-account

Quote from: suchmoon on December 30, 2020, 12:38:43 AM

Quote from: sandy-is-fine on December 30, 2020, 12:30:14 AM

Well I figure if I go back into the PM here I got the correct address from and try copy/paste it again and if it works without problem I would hopefully be OK.

That could be misleading. You already noticed it doesn't happen every time. Who knows if the malware doesn't have some logic in it to avoid detection and not replace the same address in certain circumstances. Or if it doesn't have other nasties in it like keyloggers or ransomware. Play it safe and start from scratch.

True .... and I will but just for fun I rebooted and tried the same BTC address and now it is OK.

1DBHJEnuh5bQfyWXAJD2T1166AJzViXq2R 1DBHJEnuh5bQfyWXAJD2T1166AJzViXq2R 1DBHJEnuh5bQfyWXAJD2T1166AJzViXq2R 1DBHJEnuh5bQfyWXAJD2T1166AJzViXq2R

I guess I'll just have to deal with this. It's due for a clean install anyway.

Vod

legendary

Activity: 3668

Merit: 3010

Licking my boob since 1970

sandy, what OS are you using?

If Windows 10, there are a limited number of registry entries that can do this. If you have 40 years PC experience, you could try cleaning that way.

There is a chance your BIOS could be affected as well, meaning you could reinfect the computer after reinstall. If you don't have a super complicated system, it would be prudent to flash / re-flash the BIOS to the latest version - before you format your hard drive for reinstall.

suchmoon

legendary

Activity: 3654

Merit: 8909

https://bpip.org

Quote from: sandy-is-fine on December 30, 2020, 12:30:14 AM

Well I figure if I go back into the PM here I got the correct address from and try copy/paste it again and if it works without problem I would hopefully be OK.

That could be misleading. You already noticed it doesn't happen every time. Who knows if the malware doesn't have some logic in it to avoid detection and not replace the same address in certain circumstances. Or if it doesn't have other nasties in it like keyloggers or ransomware. Play it safe and start from scratch.

sandy-is-fine

legendary

Activity: 1919

Merit: 1230

AKA Ms-overzealous-condecsending-explitive-account

Quote from: ranochigo on December 30, 2020, 12:21:32 AM

Quote from: sandy-is-fine on December 30, 2020, 12:15:31 AM

First thing I'm going to do is a restore from a full hard-drive backup from a week ago and see if it happens. At least that might save me some time. Will it still happen if I disconnect from the internet so I can tell if it is still infected?

Behavior likely persists with internet or not. The clipboard malwares that I've looked at has a whole list of addresses embedded and it'll pick a similar address from the list when it detects a Bitcoin Address in the clipboard. It doesn't require internet.

I think it won't be completely safe given how you can't identify the source of infection and your antivirus are not showing anything.

Well I figure if I go back into the PM here I got the correct address from and try copy/paste it again and if it works without problem I would hopefully be OK.

actmyname

copper member

Activity: 2562

Merit: 2504

Spear the bees

Quote from: ranochigo on December 30, 2020, 12:21:32 AM

I think it won't be completely safe given how you can't identify the source of infection and your antivirus are not showing anything.

False positives in this case are far more damaging than false negatives.

One idea would be to use this opportunity to create an air-gapped wallet: you can sign transactions from the offline device and broadcast them from another.

ranochigo

legendary

Activity: 2954

Merit: 4158

Quote from: sandy-is-fine on December 30, 2020, 12:15:31 AM

First thing I'm going to do is a restore from a full hard-drive backup from a week ago and see if it happens. At least that might save me some time. Will it still happen if I disconnect from the internet so I can tell if it is still infected?

Behavior likely persists with internet or not. The clipboard malwares that I've looked at has a whole list of addresses embedded and it'll pick a similar address from the list when it detects a Bitcoin Address in the clipboard. It doesn't require internet.

I think it won't be completely safe given how you can't identify the source of infection and your antivirus are not showing anything.

sandy-is-fine

legendary

Activity: 1919

Merit: 1230

AKA Ms-overzealous-condecsending-explitive-account

First thing I'm going to do is a restore from a full hard-drive backup from a week ago and see if it happens. At least that might save me some time. Will it still happen if I disconnect from the internet so I can tell if it is still infected?

Topic: Strange happening cutting and pasteing a bitcoin address. (Read 468 times)