September 17, 2019

InnfiRAT malware hunts for cryptocurrency info, browser cookie data


Researchers have discovered a previously unknown remote access trojan called InnfiRAT, capable of data exfiltration and digital spying.

InnfiRAT searches for users’ cryptocurrency wallet information (Bitcoin and Litecoin included), and steals browser cookie data in order to obtain victims’ usernames, passwords and session data. This information is then sent to a malicious command-and-control server, explain Zscaler researchers Sahil Antil and Rohit Chadurvedi in a company blog post published yesterday.

Written in .NET, the RAT also takes secret screenshots to capture any sensitive information that may be displayed on a user’s screen at a given time.

To avoid detection, InnfiRAT looks out for virtual machine environments and can also check for antivirus programs.

Additional technical details on InnfiRAT can be found in the blog post.



  • Want to read more?


    Next post in Malware

    Crypto Destroyer

    Be the first to comment

    Leave a Reply

    Your email address will not be published.


    *


    This site uses Akismet to reduce spam. Learn how your comment data is processed.