OkoBot: new sophisticated malware framework targets cryptocurrency users

1. Executive summary

Kaspersky has published detailed analysis of "OkoBot," a sophisticated, multi-stage malware framework active since at least April 2025 that targets cryptocurrency users via ClickFix attacks and trojanized GitHub repositories. The framework uses a malicious PowerShell downloader (TookPS) to establish an SSH tunnel, through which an automated bot deploys over 20 payloads—including the Rilide browser stealer, a keylogger, and seed-phrase phishing injectors for hardware wallets (Trezor, Ledger). Attribution is unconfirmed; Kaspersky notes Russian-language artefacts and CIS geoblocking but states it cannot attribute the campaign to any known crimeware actor. EMEA financial services clients with retail cryptocurrency custody operations or staff using hardware wallets on corporate endpoints face direct credential and seed-phrase theft risk.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The threat targets end-user workstations via social engineering and trojanized software rather than ICT third-party providers or specific financial infrastructure, and the regulatory triggers in the provided reference do not distinctly apply beyond generic incident management.

3. Technical analysis & attack chain

Attribution caveat: Attribution is unconfirmed. Kaspersky explicitly states it "can't attribute this malicious campaign to any known crimeware actor." Indicators suggesting a Russian-speaking actor (CIS geoblocking on C2 servers, Russian-language comments in SeedHunter source code, Rilide distribution on Russian-speaking forums) are observational, not confirmatory. This assessment is single-sourced (Kaspersky); verify before enforcement.

Attack chain (confirmed steps)

1. Initial access via one of two vectors: - ClickFix attack: User is tricked into executing a malicious PowerShell script (TookPS) delivered via a fake CAPTCHA/verification prompt. - Trojanized GitHub repository: A fake SQL Server Management Studio (SSMS) package hosted on GitHub (active March–June 2025) was actually a recompiled Audacity binary with a malicious implant embedded in a library. The repo's README.md mimicked Microsoft documentation.
2. SSH tunnel establishment: TookPS installs OpenSSH on the victim, connects to an attacker-controlled SSH server, and forwards the local SSH daemon port. After a delay, an automated SSH bot connects to the forwarded port.
3. System reconnaissance: The SSH bot collects username, installed AV software, IP address, and OS version. It disables Windows Defender notifications via registry modification.
4. RDP persistence: The bot patches termsrv.dll to permit multiple concurrent RDP sessions and uses "Apple Sync" to maintain a reverse SSH tunnel forwarding the local RDP port hourly.
5. Module delivery via SFTP: The SSH bot retrieves malicious modules over SFTP. The first module is HDUtil, a VMProtect-protected, obfuscated launcher (%PROGRAMDATA%\HDVideo\HDUtil.exe).
6. Browser injection (pre-March 2026 chain): HDUtil executes extl.exe (.\HDUtil.exe target extl.exe), a VMProtect-protected DLL injector. extl.exe enumerates active windows via EnumWindows/IsWindowVisible, identifies Chromium-based browser processes, and injects a payload by writing raw unencrypted bytes into allocated memory. It resolves exports LdrInitMain and LdrCallMain via a modified DJB2 hash. The injector hooks ProfileManager::BrowserListObserver::OnBrowserAdded in chrome.dll (or msedge.dll for Edge) using a YARA-style byte-pattern engine to silently install .crx extensions from %APPDATA%. Extensions are hidden from the user by patching extension-list functions to return constants. The manifest is modified with a custom_args object containing hwid and browser fields.
7. Rilide stealer deployment: The Rilide browser extension is installed via the above mechanism. Rilide steals credentials, cookies, and financial data with a focus on cryptocurrency.
8. Volume2 plugin dispatcher (post-March 2026 chain): Volume2 is executed with UAC bypass (.\HDUtil.exe target nouac noattach Volume2.exe). It loads a trojanized protobuf.dll (later renamed version.dll) via DLL hijacking. The malicious export ProtobufGetVer2 decrypts an AES-GCM payload (static 256-bit key, 96-bit nonce, GCM tag omitted). The implant communicates with C2 over HTTP using a binary format: 2-byte little-endian BotID + AES-CBC-encrypted JSON (default key/IV: 32/16 bytes of 0xff). It polls every 20 seconds. The dispatcher supports commands: reconfigure (index 1), load DLL (2), load plugin (3), restart (4), or dispatch to registered plugin (x). Plugins must export RegisterPlugin and PluginDispatch, resolved via MurmurHash3.
9. Hardware wallet seed-phrase theft: A process injector plugin injects into Trezor Suite, Ledger Wallet, and Ledger Live processes. It hooks Electron framework functions and communicates with C2 (moonsand[.]store) over HTTPS. If the C2 returns Wait: true, the malware scans for connected USB devices by VID/PID. Upon detecting a Trezor or Ledger device, it displays a hard-coded phishing page for seed phrase recovery. Entered seed phrases are captured via the console prefix @:app:print in the hooked mal_LogConsoleMessage function. Stolen phrases are exfiltrated as JSON (fields: App, Build, DeviceName, DeviceHardwareId, SeedData) and saved locally as sh_<ts>.json encrypted with RC4 using the HWID as key.
10. Keylogging and screen capture: Two modules capture user input:
    • MC Keylogger: Logs keystrokes, clipboard content (CF_HDROP, CF_DIB, CF_UNICODETEXT), and screenshots. Clipboard images saved as bf_YYYY-MM-DD hh_mm_ss.jpg; screenshots as sc_YYYY-MM-DD hh_mm_ss.jpg.
    • OkoSpyware: Targets 100+ application names (including Exodus, Litecoin QT, KeePassXC, 1Password). Uses bundled FFmpeg to capture MP4 video of target windows (%TEMP%\media_<ts>) with metadata in oko_<ts>.json. Monitors browser window titles via regex for MetaMask and Tonkeeper extension pages.
11. Exfiltration and cleanup: A PowerShell exfiltration script (delivered via TookPS scheduled task) sends all keylogger/spyware artefacts to the C2 endpoint ir-post.php, deletes local artefacts, and clears ConsoleHost_history.txt.

UAC bypass mechanism: HDUtil's target command accepts an optional nouac argument that triggers automatic UAC bypass via Windows RPC and an auto-elevated msconfig.exe (technique documented by Google Project Zero in 2019).

HWID verification: All modules verify HWID against %PROGRAMDATA%\hwid.dat (or %APPDATA%\hwid.dat). The file must contain a valid MD5 hash; modules terminate if verification fails.

4. Mitigation & containment

P1 — Within 24 hours

• Block the following domains and IPs at network egress (DNS sinkhole + firewall):
• Domains: 2baserec2[.]guru, recavb22[.]online, kbeautyreviews[.]com, coffeesaloon[.]online, livewallpapers[.]online, thatwascringe[.]com, moonsand[.]store
• IPs: 104.243.43[.]16, 104.243.32[.]213, 62.210.188[.]209
• Add SHA256 hashes of all listed malicious files to EDR block lists (see §5).
• Hunt for the presence of %PROGRAMDATA%\hwid.dat, %PROGRAMDATA%\HDVideo\HDUtil.exe, %PROGRAMDATA%\oko_ver, %USERPROFILE%\.ssh\go.bat, and %TEMP%\extl.exe across endpoints. Any hit indicates likely compromise.
• Search for unexpected SSH inbound connections or sshd processes on workstations; OkoBot installs OpenSSH and forwards port 22.

P2 — Within 72 hours

• Deploy EDR detection rules for the DLL hijacking pattern: protobuf.dll or version.dll loaded by Volume2.exe from a non-standard directory.
• Monitor for patched termsrv.dll on workstations (indicates RDP multi-session patching for persistence).
• Audit browser extension directories for .crx files in %APPDATA% and for extensions installed in "Local Extension Settings" that do not appear in the browser's extension management UI (hidden extensions).
• Review scheduled tasks for entries executing PowerShell scripts from user-writable directories (TookPS delivery mechanism).
• Block msconfig.exe auto-elevation for non-admin users via AppLocker/WDAC (mitigates the UAC bypass technique).

P3 — Within 7 days

• Educate staff on ClickFix social engineering and the risk of downloading software from GitHub repositories without verifying publisher authenticity.
• Restrict USB device connections by VID/PID for hardware wallets on endpoints not explicitly designated for crypto operations.
• Deploy YARA and Sigma rules from §6 to SIEM/EDR.
• Review browser policies to enforce extension allow-listing via Group Policy for Chromium-based browsers.
• Ensure ConsoleHost_history.txt is centrally logged or backed up before cleanup scripts can clear it (forensic preservation).

5. Indicators of compromise

md5  B07D451EE65A1580F20A784C8F0E7A46
md5  187A1F68AE786E53D3831166DC84E6D2
md5  D84E8DC509308523E0209D3CD3544619
md5  83E6B8FCB92A0B13E109301F8FF649CF
md5  7306885BB4C98F2A9F056104CF092BC9
md5  B4C2E16CDB513BE4DC798F88E2527334
md5  2157D2429124AD28DB7A26F2477CB985
md5  77CECF5E2A622AE07D8AE9913457AB57
md5  E0C3BC27A65750E740C4F1719E531C7D
md5  3D2B43F91F65BFBF36A9C71B6B418876
md5  70FEF9FD6E351F4D53CFEEE8DCDFCD99
md5  ACD31C9941B6C1CABD4E45E6877B9038
md5  DD52F5108A176C62AD807C327734AD12
md5  AC93A821617AEA1F56D4BC0BEF4AF327
md5  11DBC8A2BEA04B15F8F68F3F01E8FAF9
filepath  %USERPROFILE%\.ssh\go.bat
filepath  %PROGRAMDATA%\HDVideo\HDUtil.exe
filepath  %PROGRAMDATA%\hwid.dat
filepath  %PROGRAMDATA%\oko_ver
filepath  %TEMP%\extl.exe
filepath  %APPDATA%\hwid.dat
domain  2baserec2.guru
domain  recavb22.online
domain  kbeautyreviews.com
domain  coffeesaloon.online
domain  livewallpapers.online
domain  thatwascringe.com
domain  moonsand.store
ipv4  104.243.43.16
ipv4  104.243.32.213
ipv4  62.210.188.209

6. Detection

rule OkoBot_Framework_Components {
    meta:
        author = "Adverse Trace"
        date = "2026-07-15"
        reference = "https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/"
        description = "Detects OkoBot framework components - HDUtil launcher, extl injector, Volume2 plugin dispatcher, SeedHunter, keylogger, and OkoSpyware"
    strings:
        $hwid_file = "hwid.dat" ascii
        $hdutil_path = "HDVideo\\HDUtil.exe" ascii
        $oko_ver = "oko_ver" ascii
        $go_bat = ".ssh\\go.bat" ascii
        $protobuf_export = "ProtobufGetVer2" ascii
        $ldr_init = "LdrInitMain" ascii
        $ldr_call = "LdrCallMain" ascii
        $register_plugin = "RegisterPlugin" ascii
        $plugin_dispatch = "PluginDispatch" ascii
        $seed_prefix = "@:app:print" ascii
        $ext_table = "ext_table" ascii
        $custom_args = "custom_args" ascii
        $ir_post = "ir-post.php" ascii
        $console_history = "ConsoleHost_history.txt" ascii
        $task_index = "TaskIndex" ascii
        $task_id = "TaskID" ascii
        $oko_json = "oko_" ascii
        $media_ts = "media_" ascii
        $seedhunter = "seedhunter" ascii
        $keylog = "keylog" ascii
        $oko_dll = "oko.dll" ascii
        $ext_daemon = "ext_daemon" ascii
        $hdutil_cmd = "enumadapters" ascii
        $hdutil_cmd2 = "enumsessions" ascii
        $hdutil_cmd3 = "nouac" ascii
        $hdutil_cmd4 = "noattach" ascii
        $browser_observer = "ProfileManager::BrowserListObserver::OnBrowserAdded" ascii
        $seeddata = "SeedData" ascii
        $devicehwid = "DeviceHardwareId" ascii
    condition:
        5 of them
}

title: OkoBot Framework Indicators - File and Process Artefacts
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects file artefacts, process patterns, and network connections associated with the OkoBot malware framework
references:

    - https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/
author: Adverse Trace
date: 2026/07/15
tags:

    - attack.execution
    - attack.persistence
    - attack.defense_evasion
    - attack.credential_access
    - attack.collection
logsource:
    product: windows
    category: file_event
detection:
    selection_hwid:
        TargetFilename|endswith:

            - '\hwid.dat'
            - '\oko_ver'
    selection_hdutil:
        TargetFilename|contains:

            - 'HDVideo\HDUtil.exe'
    selection_ssh:
        TargetFilename|endswith:

            - '\.ssh\go.bat'
    selection_extl:
        TargetFilename|endswith:

            - '\extl.exe'
    selection_protobuf:
        TargetFilename|endswith:

            - '\protobuf.dll'
            - '\version.dll'
        TargetFilename|contains:

            - 'Volume2'
    condition: selection_hwid or selection_hdutil or selection_ssh or selection_extl or selection_protobuf
falsepositives:

    - Legitimate Volume2 audio utility with authentic protobuf.dll (verify code signature)
level: high

title: OkoBot Framework - SSH Bot and C2 Network Connections
id: 8b4d2f3e-9c5e-4b7f-0d6e-2e3f4a5b6c7d
status: experimental
description: Detects network connections to OkoBot C2 infrastructure and unexpected SSH daemon activity on workstations
references:

    - https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/
author: Adverse Trace
date: 2026/07/15
tags:

    - attack.command_and_control
    - attack.t1571
    - attack.t1572
logsource:
    product: windows
    category: network_connection
detection:
    selection_c2_domains:
        DestinationHostname|endswith:

            - '2baserec2.guru'
            - 'recavb22.online'
            - 'kbeautyreviews.com'
            - 'coffeesaloon.online'
            - 'livewallpapers.online'
            - 'thatwascringe.com'
            - 'moonsand.store'
    selection_c2_ips:
        DestinationIp:

            - '104.243.43.16'
            - '104.243.32.213'
            - '62.210.188.209'
    selection_ssh_workstation:
        DestinationPort: 22
        Image|endswith:

            - '\ssh.exe'
    condition: selection_c2_domains or selection_c2_ips
falsepositives:

    - Legitimate SSH usage by IT administrators (correlate with user context)
level: high

7. Sources

• Kaspersky Securelist, "OkoBot: new sophisticated malware framework targets cryptocurrency users," https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/, 2026-07-15

8. Adverse Trace position

OkoBot is a high-capability, actively maintained framework that poses a direct threat to any organisation where staff manage cryptocurrency assets on Windows endpoints. The combination of SSH-tunnel-based C2, hidden browser extension injection, hardware-wallet seed-phrase phishing, and screen-capture keylogging gives the operator full-cycle credential theft with strong operational security. Attribution is unconfirmed and single-sourced (Kaspersky only); we assess with moderate confidence that the actor is Russian-speaking based on the reported linguistic artefacts and geoblocking, but this does not constitute named-actor attribution. The framework's evolution from April 2025 through March 2026 — replacing the HDUtil/extl/Rilide chain with a plugin dispatcher — indicates active development and adaptation. Clients should prioritise network-level blocking of the listed C2 infrastructure, endpoint hunting for hwid.dat and HDUtil.exe, and browser extension allow-listing. We will monitor for additional IoCs from Kaspersky's threat intelligence reporting and update this advisory if attribution is confirmed or new campaign waves are identified.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.