Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/girlinthespiderswebrazymalware.php}} {{Unattributed Sources}} Trailer And Modified WikipediaMalware was discovered distributing via a malicious LNK file, which installed malware on the user's computer when they tried to download a torrent for the popular hacking movie The Girl In The Spider's Web. This malware would replace cryptocurrency address, insert ads on..."

2023-11-10T16:28:01Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/girlinthespiderswebrazymalware.php}} {{Unattributed Sources}} thumb|Trailer And Modified WikipediaMalware was discovered distributing via a malicious LNK file, which installed malware on the user's computer when they tried to download a torrent for the popular hacking movie The Girl In The Spider's Web. This malware would replace cryptocurrency address, insert ads on..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/girlinthespiderswebrazymalware.php}}
{{Unattributed Sources}}

[[File:Girlinspidersweb.jpg|thumb|Trailer And Modified Wikipedia]]Malware was discovered distributing via a malicious LNK file, which installed malware on the user's computer when they tried to download a torrent for the popular hacking movie The Girl In The Spider's Web. This malware would replace cryptocurrency address, insert ads on many websites, and create a fake Wikipedia donation banner with the attacker's cryptocurrency wallet addresses. A small amount of funds were generated through the Wikipedia donations and it's unclear how well the other methods worked.

This is a global/international case not involving a specific country.<ref name="cryptoglobe-12124" /><ref name="cryptoglobe-12125" /><ref name="bleepingcomputer-12126" /><ref name="securelist-12127" /><ref name="youtube-12128" /><ref name="blockchaindotcom-12129" /><ref name="etherscan-12130" /><ref name="coinmarketcap-4651" />

== About None ==
"CryptoGlobe has reported on several instances where viruses and malware were deployed to steal cryptocurrency.

One scenario involved cryptojacking software buried in [a] fake copy of a torrented movie that would redirect crypto payments whenever possible. The malicious software would scan websites for cryptocurrency addresses and then replace them with ones owned by the attackers. The virus would also falsify search results and create fake advertisements."

"A malicious Windows shortcut file posing as a movie via The Pirate Bay torrent tracker can trigger a chain of mischievous activities on your computer, like injecting content from the attacker into high-profile web sites such as Wikipedia, Google and Yandex Search or by stealing cryptocurrency."

"The exploit suite, found in a fake copy of the movie The Girl in the Spider’s Web (garnering a 40% on Rotten Tomatoes), targets the Windows operating system only. While very robust, the exploit can only target fast-clickers, as the malicious file is not even a media playing filetype, but instead a .LNK shortcut. Bleepingcomputer cited security experts in saying that “weaponized .LNK files are common in pirated content.”"

"The file opens many attack vectors. One of them produces fake ads and search results on Google and Yandex, by hijacking both Chrome and Firefox browsers to do its bidding, and downloads extensions it needs to function. It deviously redirects searches for things like “spyware” to custom, fake anti-spyware software which is in fact yet more malicious software."

"The malicious activity extends to other web pages, including Google and Yandex search results, and on Wikipedia entries. Another goal is to monitor web pages for Bitcoin and Ethereum wallet addresses and replaces them with others belonging to the attacker.

To do this, the malware modifies registry keys to disable Windows Defender protection if Microsoft's antivirus is enabled. It also forcibly installs in Firefox an extension called 'Firefox Protection' and hijacks the Chrome extension called 'Chrome Media Router', with the ID "pkedcjkdefgpdelpbcmbmeomcjbeemfm.""

"Wikipedia is also targeted when users visit the site, with a fake donation box injected into the page that appears presenting bitcoin and ether addresses (neither has seemed to phish too much coin)." "If the victim goes to Wikipedia, the malware's injection mechanism inserts a fake donation banner that states Wikipedia now accepts cryptocurrency donations and provides two cryptocurrency addresses to send "donate" to."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Girl in the Spider's Web Razy Malware
!Date
!Event
!Description
|-
|January 12th, 2019 10:50:56 AM MST
|BleepingComputer Article
|BleepingComputer reports on the malware.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $2,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="cryptoglobe-12124">[https://www.cryptoglobe.com/latest/2019/01/malicious-browser-extension-racks-up-stolen-bitcoin-from-unsuspecting-users/ Malicious Browser Extension Racks Up Stolen Bitcoin From Unsuspecting Users | Cryptoglobe] (Dec 28, 2022)</ref>

<ref name="cryptoglobe-12125">[https://www.cryptoglobe.com/latest/2019/01/crypto-stealing-virus-found-in-torrented-movie-file-targeting-windows/ Crypto-Stealing Virus Found in Torrented Movie File, Targeting Windows | Cryptoglobe] (Oct 27, 2023)</ref>

<ref name="bleepingcomputer-12126">[https://www.bleepingcomputer.com/news/security/fake-movie-file-infects-pc-to-steal-cryptocurrency-poison-google-results/ Fake Movie File Infects PC to Steal Cryptocurrency, Poison Google Results] (Oct 27, 2023)</ref>

<ref name="securelist-12127">[https://securelist.com/razy-in-search-of-cryptocurrency/89485/ Spoofing search results and infecting browser extensions: Razy in search of cryptocurrency | Securelist] (Oct 27, 2023)</ref>

<ref name="youtube-12128">[https://www.youtube.com/watch?v=XKMSP9OKspQ THE GIRL IN THE SPIDER'S WEB - Official Trailer (HD) - YouTube] (Oct 27, 2023)</ref>

<ref name="blockchaindotcom-12129">[https://www.blockchain.com/explorer/addresses/btc/1LVcPYWqCjsAyACk7Pf9tcbHYuzF6K94T7 Address: 1LVcPYWqCjsAyACk7Pf9tcbHYuzF6K94T7] (Oct 27, 2023)</ref>

<ref name="etherscan-12130">[https://etherscan.io/address/0x33a7305ae6b77f3810364e89821e9b22e6a22d43 Address 0x33a7305ae6b77f3810364e89821e9b22e6a22d43 | Etherscan] (Oct 27, 2023)</ref>

<ref name="coinmarketcap-4651">[https://coinmarketcap.com/currencies/ethereum/historical-data/ https://coinmarketcap.com/currencies/ethereum/historical-data/] (Dec 21, 2021)</ref></references>

Girl in the Spider's Web Razy Malware - Revision history