Doublefinger

DoubleFinger, a sophisticated malware originating from China, was reported in June 2023 to be used in complex attacks aimed at stealing cryptocurrency. The malware operates as a five-stage, shellcode-style loader that conceals its payloads within PNG image files, which it downloads from the image-sharing platform Imgur.com. DoubleFinger's intricate multi-stage infection mechanism bears resemblance to attacks orchestrated by Advanced Persistent Threat (APT) actors and is associated with ChamelGang. It employs DNS-over-HTTPS and Tunneling techniques, and uses tools such as ChamelDoH, FRP, and LinuxPrivilegeElevator, making it a potent threat. The malware's operation involves installing a crypto-stealer and a remote access Trojan (RAT), both of which are designed to exploit and damage targeted systems, particularly those running on Linux. This stealthy loading process and payload deployment are intended to evade detection by antivirus and endpoint detection and response (EDR) systems. In addition to these threats, DoubleFinger abuses AES128, base64, and C++ to further its malicious activities. By October 2023, an evolved version of DoubleFinger, known as ASMCrypt, emerged. Developed by cybercriminals, ASMCrypt is a novel malware crypter and loader that builds upon the stealthy capabilities of DoubleFinger. It was initially used to facilitate the deployment of the GreetingGhoul cryptocurrency stealer. This evolution of DoubleFinger also serves as a gateway to the TOR network, enhancing its ability to conduct covert operations and posing an increased threat to cybersecurity.