- SHA1: 177c6d83200d0aaafafa04e8fb3295c5c061fd8f
Description
An Android trojan built into one of the Bitpie crypto wallet’s modified versions. It steals mnemonic seed phrases used to access crypto wallets and sends them to the attackers’ server. Malware creators distribute this trojan through specially created malicious websites that copy the appearance of Bitpie project’s genuine website.
A comparison between the genuine website (left) and fake one (right):
Operating routine
The Android.CoinSteal.8 is a full-fledged version of the Bitpie application with implanted malicious functionality. It looks and operates just like the original safe version. The data theft goes unnoticed by the users.
Upon launch, the trojan displays the app’s main menu. There, the user can either create new crypto wallets or import already existing ones.
In both cases, the user has to enter their seed phrase for authorization into the corresponding field. At that, the seed phrase is covertly sent to the C&C server located at hxxps://api[.]btipie[.]com/api/:
Corresponding methods calls responsible for a server request:
