Author(s): Vlad Pasca Executive Summary Threat actor distributes malicious cryptocurrency wallets (Anchor, Zec, Iota, Onto, Dark, and Stellar) as oversized Advanced Installer packages exceeding 600MB to evade detection. Attacker-controlled domains achieve first page search engine rankings for targeted wallet names, intercepting users searching for legitimate cryptocurrency wallets. The campaign exhibits cross-platform targeting with Windows, Linux, and macOS variants, though Linux and macOS versions of certain wallets remain non-malicious in some instances. Initial executable files are signed with valid code signing certificates to establish false legitimacy and bypass security controls. The campaign's objective is deploying Remote Utilities (RuRAT) remote management tool to establish persistent access on compromised systems. Low-confidence attribution to a Russian-aligned threat actor based on Remote Utilities binary hash correlation with Ukraine CERT-UA report 5961 and Russian-language strings identified in analyzed samples. Domain registration timelines demonstrate the campaign's extended operational lifespan, spanning multiple years from initial infrastructure establishment to ongoing activity. Timeline of distribution domains registration The infection vector utilizes Advanced Installer executables containing batch scripts that orchestrate the download and execution of MSI files from threat actor infrastructure. This layered deployment mechanism culminates in the installation of Remote Utilities (RuRAT) for persistent remote access. Persistence is achieved by creating multiple scheduled tasks on the infected host. RuRAT (RMS) is a legitimate Russian-made remote management utility that is publicly available for trial and purchase. The tool offers a full suite of features that allows the threat actors to deploy additional malware, exfiltrate data, and perform other activities. The following fake crypto wallets were created and distributed by the threat actor: A Deeper Dive We analyzed the 600MB+ null-padded Advanced Installer package that can be downloaded from the fake cryptocurrency wallet domain anchorwallet[.]org (SHA256: 553e3f0483580289f64e55d6646be3c4b530fe275519e510f659460d3bacfa08) . This impersonates the legitimate Anchor Wallet that can be downloaded from greymass[.]com/anchor#download (Windows, Linux, and macOS versions). The hash of the fake Anchor Wallet is displayed on the downloading page, however, the Windows hash is different from the real hash of the file downloaded from the domain. The Linux and macOS hashes are the same as that of the legitimate Anchor Wallet. Figure 1 - Download page of anchorwallet[.]org All versions of the fake DarkWallet from darkwallet[.]is are malicious. The Linux and macOS installers are Electron-based and drop an infostealer. Figure 2 - Download page of darkwallet[.]is The Python script can be used to extract the embedded files from Advanced Installer executables in most cases. The extracted file called “ Anchors.ini ” contains an MSI file that will be downloaded from zorvexion24[.]com/file/install.msi. Similar “ .ini ” files can be extracted from all Advanced Installer executables representing the other fake wallets. Filename Description 1display.bat Hide notification area and kill explorer.exe 3.1setuphd.bat Verify whether Task Manager is active and stop two RMM processes called rutserv and rfusclient 4h.bat Hide multiple components of the malicious activity on the infected machine 6last.bat, 9last.bat Hide multiple components of the malicious activity on the infected machine 7SecurityCenter.bat Restart explorer.exe 8display2.bat Show notification area 10setup2.bat Download and deploy the RMM tools on the host Setup3.bat Establish persistence using scheduled tasks The batch file “ 1display.bat ” hides the notification area by setting the “ NoTrayItemsDisplay ” registry value to 1. It also kills the explorer.exe process using PowerShell: Figure 3 - 1display.bat The file named “ 3.1setuphd.bat ” creates a PowerShell script called “ hd.ps1 ” in the “ C:\Users\Public ” directory. The purpose of the newly created script is to verify whether Task Manager is running and kills two processes called “ rutserv ” and “ rfusclient ”. We’ll see during the analysis that these two files are RMM tools that are installed by the malicious process. Figure 4 - 3.1setuphd.bat The malware adds the “ System ” and “ Hidden ” flags to multiple files and directories that are created during the malicious activity. It also modifies the “ ShowSuperHidden ” registry value to 2 and hides the installed application from Control Panel (Figure 5). Figure 5 - 4h.bat Files “ 6last.bat ” and “ 9last.bat ” are identical and set the same flags to a new directory called “ Remote Utilities ” from the “ ProgramData ” folder: Figure 6 - 6last.bat Using the “ 7SecurityCenter.bat ” script, the malware creates a batch script in the Startup folder that restarts the explorer process. Figure 7 - 7SecurityCe...