We found updated samples of the CopperStealer malware infecting systems via websites hosting fake software. We examined this new version reusing parts of code and observed the following similarities from previous versions:.
This shellcode reads an offset of the payload and XOR decryption key from the executable file header, which is the same method that we described in our report. As highlighted in the screenshot, the encryption key is 0xeb1c0, which is in decimal. The decimal value is both the offset and the encryption key. All the samples we analyzed use the same scheme. The following screenshot shows the beginning of the encrypted data. The decryption is an XOR function with the same key as offset in decimal.
It's important to note that in older versions of CopperStealer, this was called WorkIn, while newer versions already had HelloWorld. We analyzed the second stage as a dropper embedding two additional executables compressed with 7-Zip , internally named A and B.
This component uses the same payload encryption technique and the same export method name as the routine discussed in the first stage. The component installs a certificate with a thumbprint 6c0ce2ddc47cacff19facdd in the Certificates folder of the current user.
The same certificate is mentioned in the indicators of compromise IOC section of another report and is also assigned to CopperStealer.
