> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # OkoBot: new sophisticated malware framework targets cryptocurrency users - URL: https://f4n6.co.uk/security-feed/okobot-new-sophisticated-malware-framework-targets-cryptocurrency-users/ - Published: 2026-07-15T10:27:06.000Z - Updated: 2026-07-15T10:27:06.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Kaspersky has published detailed analysis of "OkoBot," a sophisticated, multi-stage malware framework active since at least April 2025 that targets cryptocurrency users via ClickFix attacks and trojanized GitHub repositories. The framework uses a malicious PowerShell downloader (TookPS) to establish an SSH tunnel, through which an automated bot deploys over 20 payloads—including the Rilide browser stealer, a keylogger, and seed-phrase phishing injectors for hardware wallets (Trezor, Ledger). Attribution is unconfirmed; Kaspersky notes Russian-language artefacts and CIS geoblocking but states it cannot attribute the campaign to any known crimeware actor. EMEA financial services clients with retail cryptocurrency custody operations or staff using hardware wallets on corporate endpoints face direct credential and seed-phrase theft risk. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The threat targets end-user workstations via social engineering and trojanized software rather than ICT third-party providers or specific financial infrastructure, and the regulatory triggers in the provided reference do not distinctly apply beyond generic incident management. ## 3\. Technical analysis & attack chain **Attribution caveat:** Attribution is unconfirmed. Kaspersky explicitly states it "can't attribute this malicious campaign to any known crimeware actor." Indicators suggesting a Russian-speaking actor (CIS geoblocking on C2 servers, Russian-language comments in SeedHunter source code, Rilide distribution on Russian-speaking forums) are observational, not confirmatory. This assessment is single-sourced (Kaspersky); verify before enforcement. ### Attack chain (confirmed steps) 1. **Initial access** via one of two vectors: - **ClickFix attack:** User is tricked into executing a malicious PowerShell script (TookPS) delivered via a fake CAPTCHA/verification prompt. - **Trojanized GitHub repository:** A fake SQL Server Management Studio (SSMS) package hosted on GitHub (active March–June 2025) was actually a recompiled Audacity binary with a malicious implant embedded in a library. The repo's `README.md` mimicked Microsoft documentation. 2. **SSH tunnel establishment:** TookPS installs OpenSSH on the victim, connects to an attacker-controlled SSH server, and forwards the local SSH daemon port. After a delay, an automated SSH bot connects to the forwarded port. 3. **System reconnaissance:** The SSH bot collects username, installed AV software, IP address, and OS version. It disables Windows Defender notifications via registry modification. 4. **RDP persistence:** The bot patches `termsrv.dll` to permit multiple concurrent RDP sessions and uses "Apple Sync" to maintain a reverse SSH tunnel forwarding the local RDP port hourly. 5. **Module delivery via SFTP:** The SSH bot retrieves malicious modules over SFTP. The first module is HDUtil, a VMProtect-protected, obfuscated launcher (`%PROGRAMDATA%\HDVideo\HDUtil.exe`). 6. **Browser injection (pre-March 2026 chain):** HDUtil executes `extl.exe` (`.\HDUtil.exe target extl.exe`), a VMProtect-protected DLL injector. `extl.exe` enumerates active windows via `EnumWindows`/`IsWindowVisible`, identifies Chromium-based browser processes, and injects a payload by writing raw unencrypted bytes into allocated memory. It resolves exports `LdrInitMain` and `LdrCallMain` via a modified DJB2 hash. The injector hooks `ProfileManager::BrowserListObserver::OnBrowserAdded` in `chrome.dll` (or `msedge.dll` for Edge) using a YARA-style byte-pattern engine to silently install `.crx` extensions from `%APPDATA%`. Extensions are hidden from the user by patching extension-list functions to return constants. The manifest is modified with a `custom_args` object containing `hwid` and `browser` fields. 7. **Rilide stealer deployment:** The Rilide browser extension is installed via the above mechanism. Rilide steals credentials, cookies, and financial data with a focus on cryptocurrency. 8. **Volume2 plugin dispatcher (post-March 2026 chain):** Volume2 is executed with UAC bypass (`.\HDUtil.exe target nouac noattach Volume2.exe`). It loads a trojanized `protobuf.dll` (later renamed `version.dll`) via DLL hijacking. The malicious export `ProtobufGetVer2` decrypts an AES-GCM payload (static 256-bit key, 96-bit nonce, GCM tag omitted). The implant communicates with C2 over HTTP using a binary format: 2-byte little-endian BotID + AES-CBC-encrypted JSON (default key/IV: 32/16 bytes of `0xff`). It polls every 20 seconds. The dispatcher supports commands: reconfigure (index 1), load DLL (2), load plugin (3), restart (4), or dispatch to registered plugin (x). Plugins must export `RegisterPlugin` and `PluginDispatch`, resolved via MurmurHash3. 9. **Hardware wallet seed-phrase theft:** A process injector plugin injects into Trezor Suite, Ledger Wallet, and Ledger Live processes. It hooks Electron framework functions and communicates with C2 (`moonsand[.]store`) over HTTPS. If the C2 returns `Wait: true`, the malware scans for connected USB devices by VID/PID. Upon detecting a Trezor or Ledger device, it displays a hard-coded phishing page for seed phrase recovery. Entered seed phrases are captured via the console prefix `@:app:print` in the hooked `mal_LogConsoleMessage` function. Stolen phrases are exfiltrated as JSON (fields: `App`, `Build`, `DeviceName`, `DeviceHardwareId`, `SeedData`) and saved locally as `sh_.json` encrypted with RC4 using the HWID as key. 10. **Keylogging and screen capture:** Two modules capture user input: - **MC Keylogger:** Logs keystrokes, clipboard content (`CF_HDROP`, `CF_DIB`, `CF_UNICODETEXT`), and screenshots. Clipboard images saved as `bf_YYYY-MM-DD hh_mm_ss.jpg`; screenshots as `sc_YYYY-MM-DD hh_mm_ss.jpg`. - **OkoSpyware:** Targets 100+ application names (including Exodus, Litecoin QT, KeePassXC, 1Password). Uses bundled FFmpeg to capture MP4 video of target windows (`%TEMP%\media_`) with metadata in `oko_.json`. Monitors browser window titles via regex for MetaMask and Tonkeeper extension pages. 11. **Exfiltration and cleanup:** A PowerShell exfiltration script (delivered via TookPS scheduled task) sends all keylogger/spyware artefacts to the C2 endpoint `ir-post.php`, deletes local artefacts, and clears `ConsoleHost_history.txt`. **UAC bypass mechanism:** HDUtil's `target` command accepts an optional `nouac` argument that triggers automatic UAC bypass via Windows RPC and an auto-elevated `msconfig.exe` (technique documented by Google Project Zero in 2019). **HWID verification:** All modules verify HWID against `%PROGRAMDATA%\hwid.dat` (or `%APPDATA%\hwid.dat`). The file must contain a valid MD5 hash; modules terminate if verification fails. ## 4\. Mitigation & containment ### P1 — Within 24 hours - Block the following domains and IPs at network egress (DNS sinkhole + firewall): - Domains: `2baserec2[.]guru`, `recavb22[.]online`, `kbeautyreviews[.]com`, `coffeesaloon[.]online`, `livewallpapers[.]online`, `thatwascringe[.]com`, `moonsand[.]store` - IPs: `104.243.43[.]16`, `104.243.32[.]213`, `62.210.188[.]209` - Add SHA256 hashes of all listed malicious files to EDR block lists (see §5). - Hunt for the presence of `%PROGRAMDATA%\hwid.dat`, `%PROGRAMDATA%\HDVideo\HDUtil.exe`, `%PROGRAMDATA%\oko_ver`, `%USERPROFILE%\.ssh\go.bat`, and `%TEMP%\extl.exe` across endpoints. Any hit indicates likely compromise. - Search for unexpected SSH inbound connections or `sshd` processes on workstations; OkoBot installs OpenSSH and forwards port 22. ### P2 — Within 72 hours - Deploy EDR detection rules for the DLL hijacking pattern: `protobuf.dll` or `version.dll` loaded by `Volume2.exe` from a non-standard directory. - Monitor for patched `termsrv.dll` on workstations (indicates RDP multi-session patching for persistence). - Audit browser extension directories for `.crx` files in `%APPDATA%` and for extensions installed in "Local Extension Settings" that do not appear in the browser's extension management UI (hidden extensions). - Review scheduled tasks for entries executing PowerShell scripts from user-writable directories (TookPS delivery mechanism). - Block `msconfig.exe` auto-elevation for non-admin users via AppLocker/WDAC (mitigates the UAC bypass technique). ### P3 — Within 7 days - Educate staff on ClickFix social engineering and the risk of downloading software from GitHub repositories without verifying publisher authenticity. - Restrict USB device connections by VID/PID for hardware wallets on endpoints not explicitly designated for crypto operations. - Deploy YARA and Sigma rules from §6 to SIEM/EDR. - Review browser policies to enforce extension allow-listing via Group Policy for Chromium-based browsers. - Ensure `ConsoleHost_history.txt` is centrally logged or backed up before cleanup scripts can clear it (forensic preservation). ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | --------------------------------------------------------- | ---------- | --------- | | md5 | B07D451EE65A1580F20A784C8F0E7A46 (protobuf.dll) | High | Kaspersky | | md5 | 187A1F68AE786E53D3831166DC84E6D2 (protobuf.dll) | High | Kaspersky | | md5 | D84E8DC509308523E0209D3CD3544619 (protobuf.dll) | High | Kaspersky | | md5 | 83E6B8FCB92A0B13E109301F8FF649CF (version.dll) | High | Kaspersky | | md5 | 7306885BB4C98F2A9F056104CF092BC9 (PowerShell wrapper) | High | Kaspersky | | md5 | B4C2E16CDB513BE4DC798F88E2527334 (CMD wrapper) | High | Kaspersky | | md5 | 2157D2429124AD28DB7A26F2477CB985 (Environment enumerator) | High | Kaspersky | | md5 | 77CECF5E2A622AE07D8AE9913457AB57 (Dropper) | High | Kaspersky | | md5 | E0C3BC27A65750E740C4F1719E531C7D (Process injector) | High | Kaspersky | | md5 | 3D2B43F91F65BFBF36A9C71B6B418876 (ext\_daemon.exe) | High | Kaspersky | | md5 | 70FEF9FD6E351F4D53CFEEE8DCDFCD99 (seedhunter\_x64.exe) | High | Kaspersky | | md5 | ACD31C9941B6C1CABD4E45E6877B9038 (keylog\_x64.dll) | High | Kaspersky | | md5 | DD52F5108A176C62AD807C327734AD12 (oko.dll) | High | Kaspersky | | md5 | AC93A821617AEA1F56D4BC0BEF4AF327 (HDUtil.exe) | High | Kaspersky | | md5 | 11DBC8A2BEA04B15F8F68F3F01E8FAF9 (extl.exe) | High | Kaspersky | | filepath | %USERPROFILE%.ssh\\go.bat | High | Kaspersky | | filepath | %PROGRAMDATA%\\HDVideo\\HDUtil.exe | High | Kaspersky | | filepath | %PROGRAMDATA%\\hwid.dat | High | Kaspersky | | filepath | %PROGRAMDATA%\\oko\_ver | High | Kaspersky | | filepath | %TEMP%\\extl.exe | High | Kaspersky | | filepath | %APPDATA%\\hwid.dat | High | Kaspersky | | domain | 2baserec2\[.\]guru | High | Kaspersky | | domain | recavb22\[.\]online | High | Kaspersky | | domain | kbeautyreviews\[.\]com | High | Kaspersky | | domain | coffeesaloon\[.\]online | High | Kaspersky | | domain | livewallpapers\[.\]online | High | Kaspersky | | domain | thatwascringe\[.\]com | High | Kaspersky | | domain | moonsand\[.\]store | High | Kaspersky | | ipv4 | 104.243.43.16 | High | Kaspersky | | ipv4 | 104.243.32.213 | High | Kaspersky | | ipv4 | 62.210.188.209 | High | Kaspersky | ```iocs md5 B07D451EE65A1580F20A784C8F0E7A46 md5 187A1F68AE786E53D3831166DC84E6D2 md5 D84E8DC509308523E0209D3CD3544619 md5 83E6B8FCB92A0B13E109301F8FF649CF md5 7306885BB4C98F2A9F056104CF092BC9 md5 B4C2E16CDB513BE4DC798F88E2527334 md5 2157D2429124AD28DB7A26F2477CB985 md5 77CECF5E2A622AE07D8AE9913457AB57 md5 E0C3BC27A65750E740C4F1719E531C7D md5 3D2B43F91F65BFBF36A9C71B6B418876 md5 70FEF9FD6E351F4D53CFEEE8DCDFCD99 md5 ACD31C9941B6C1CABD4E45E6877B9038 md5 DD52F5108A176C62AD807C327734AD12 md5 AC93A821617AEA1F56D4BC0BEF4AF327 md5 11DBC8A2BEA04B15F8F68F3F01E8FAF9 filepath %USERPROFILE%\.ssh\go.bat filepath %PROGRAMDATA%\HDVideo\HDUtil.exe filepath %PROGRAMDATA%\hwid.dat filepath %PROGRAMDATA%\oko_ver filepath %TEMP%\extl.exe filepath %APPDATA%\hwid.dat domain 2baserec2.guru domain recavb22.online domain kbeautyreviews.com domain coffeesaloon.online domain livewallpapers.online domain thatwascringe.com domain moonsand.store ipv4 104.243.43.16 ipv4 104.243.32.213 ipv4 62.210.188.209 ``` ## 6\. Detection ```yara rule OkoBot_Framework_Components { meta: author = "Adverse Trace" date = "2026-07-15" reference = "https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/" description = "Detects OkoBot framework components - HDUtil launcher, extl injector, Volume2 plugin dispatcher, SeedHunter, keylogger, and OkoSpyware" strings: $hwid_file = "hwid.dat" ascii $hdutil_path = "HDVideo\\HDUtil.exe" ascii $oko_ver = "oko_ver" ascii $go_bat = ".ssh\\go.bat" ascii $protobuf_export = "ProtobufGetVer2" ascii $ldr_init = "LdrInitMain" ascii $ldr_call = "LdrCallMain" ascii $register_plugin = "RegisterPlugin" ascii $plugin_dispatch = "PluginDispatch" ascii $seed_prefix = "@:app:print" ascii $ext_table = "ext_table" ascii $custom_args = "custom_args" ascii $ir_post = "ir-post.php" ascii $console_history = "ConsoleHost_history.txt" ascii $task_index = "TaskIndex" ascii $task_id = "TaskID" ascii $oko_json = "oko_" ascii $media_ts = "media_" ascii $seedhunter = "seedhunter" ascii $keylog = "keylog" ascii $oko_dll = "oko.dll" ascii $ext_daemon = "ext_daemon" ascii $hdutil_cmd = "enumadapters" ascii $hdutil_cmd2 = "enumsessions" ascii $hdutil_cmd3 = "nouac" ascii $hdutil_cmd4 = "noattach" ascii $browser_observer = "ProfileManager::BrowserListObserver::OnBrowserAdded" ascii $seeddata = "SeedData" ascii $devicehwid = "DeviceHardwareId" ascii condition: 5 of them } ``` ```yaml title: OkoBot Framework Indicators - File and Process Artefacts id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c status: experimental description: Detects file artefacts, process patterns, and network connections associated with the OkoBot malware framework references: - https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/ author: Adverse Trace date: 2026/07/15 tags: - attack.execution - attack.persistence - attack.defense_evasion - attack.credential_access - attack.collection logsource: product: windows category: file_event detection: selection_hwid: TargetFilename|endswith: - '\hwid.dat' - '\oko_ver' selection_hdutil: TargetFilename|contains: - 'HDVideo\HDUtil.exe' selection_ssh: TargetFilename|endswith: - '\.ssh\go.bat' selection_extl: TargetFilename|endswith: - '\extl.exe' selection_protobuf: TargetFilename|endswith: - '\protobuf.dll' - '\version.dll' TargetFilename|contains: - 'Volume2' condition: selection_hwid or selection_hdutil or selection_ssh or selection_extl or selection_protobuf falsepositives: - Legitimate Volume2 audio utility with authentic protobuf.dll (verify code signature) level: high ``` ```yaml title: OkoBot Framework - SSH Bot and C2 Network Connections id: 8b4d2f3e-9c5e-4b7f-0d6e-2e3f4a5b6c7d status: experimental description: Detects network connections to OkoBot C2 infrastructure and unexpected SSH daemon activity on workstations references: - https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/ author: Adverse Trace date: 2026/07/15 tags: - attack.command_and_control - attack.t1571 - attack.t1572 logsource: product: windows category: network_connection detection: selection_c2_domains: DestinationHostname|endswith: - '2baserec2.guru' - 'recavb22.online' - 'kbeautyreviews.com' - 'coffeesaloon.online' - 'livewallpapers.online' - 'thatwascringe.com' - 'moonsand.store' selection_c2_ips: DestinationIp: - '104.243.43.16' - '104.243.32.213' - '62.210.188.209' selection_ssh_workstation: DestinationPort: 22 Image|endswith: - '\ssh.exe' condition: selection_c2_domains or selection_c2_ips falsepositives: - Legitimate SSH usage by IT administrators (correlate with user context) level: high ``` ## 7\. Sources - Kaspersky Securelist, "OkoBot: new sophisticated malware framework targets cryptocurrency users," https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/, 2026-07-15 ## 8\. Adverse Trace position OkoBot is a high-capability, actively maintained framework that poses a direct threat to any organisation where staff manage cryptocurrency assets on Windows endpoints. The combination of SSH-tunnel-based C2, hidden browser extension injection, hardware-wallet seed-phrase phishing, and screen-capture keylogging gives the operator full-cycle credential theft with strong operational security. Attribution is unconfirmed and single-sourced (Kaspersky only); we assess with moderate confidence that the actor is Russian-speaking based on the reported linguistic artefacts and geoblocking, but this does not constitute named-actor attribution. The framework's evolution from April 2025 through March 2026 — replacing the HDUtil/extl/Rilide chain with a plugin dispatcher — indicates active development and adaptation. Clients should prioritise network-level blocking of the listed C2 infrastructure, endpoint hunting for `hwid.dat` and `HDUtil.exe`, and browser extension allow-listing. We will monitor for additional IoCs from Kaspersky's threat intelligence reporting and update this advisory if attribution is confirmed or new campaign waves are identified. --- [Read the original source →](https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*