A novel modular modular crypto-wallet stealing malware dubbed ‘BHUNT’ has been spotted targeting cryptocurrency wallet contents, passwords, and security phrases. The malware is packed and heavily encrypted using Themida and VMProtect, two virtual machine packers that hinder reverse-engineering and analysis by researchers. The threat actors signed the malware with a digital signature stolen from Piriform, the makers of CCleaner, but as the malware developers copied it from an unrelated executable, it’s marked as invalid due to a binary mismatch. The main component of the malware is’mscrlib.exe,’ which extracts further modules that are launched on an infected system.”]