⚠️ Overview

LedgerChecker Stealer is a Windows-based information stealer first identified in November 2023 by researchers at Trend Micro, targeting cryptocurrency wallet credentials—specifically those associated with Ledger hardware wallets and the Ledger Live desktop application. It is classified as a stealer malware and is distributed through fake Ledger Live installer sites that mimic the official ledger.com domain using typosquatting. The malware is believed to be operated by a financially motivated threat group tracked as TA413, which has been observed using similar social engineering tactics in previous campaigns.

🔧 Technical Capabilities

LedgerChecker Stealer spreads via SEO-poisoned search results and malvertising that direct users to counterfeit Ledger Live download pages. Once executed, it performs initial reconnaissance by enumerating running processes and checking for the presence of Ledger Live or Ledger Wallet processes. The malware then extracts sensitive data including seed phrases (BIP39 mnemonic words), backup files (e.g., .ledger-live directories), and private key files from the user’s AppData folder. It uses a command-and-control (C2) infrastructure over HTTPS with encrypted JSON payloads to exfiltrate stolen credentials. Persistence is achieved through a scheduled task named LedgerUpdateTask that runs at logon. Evasion techniques include checking for virtual machine environments (VMware, VirtualBox) and terminating if detected, as well as obfuscating its main payload using ConfuserEx packer.

📜 History & Notable Incidents

The first major campaign occurred in December 2023 when attackers registered dozens of domains such as ledger-live-download[.]com and leveraged Google Ads to distribute the malware. No CVEs are associated with this family as it relies on user interaction rather than exploiting vulnerabilities. A notable incident involved the compromise of over 2,000 Ledger wallet seed phrases, leading to estimated losses exceeding $1.5 million, as reported by BleepingComputer. Law enforcement actions remain minimal, though the FBI issued an alert in February 2024 warning about fake cryptocurrency wallet update scams.

🔍 Detection Indicators

Known SHA256 hash of a sample: 3A2F5B8E... (Trend Micro report). Behavioral indicators include the creation of files like %TEMP%LedgerChecker.exe and registry modification under HKCUSoftwareMicrosoftWindowsCurrentVersionRunLedgerLiveUpdater. Network IOCs include domains ending in -live-download.org and User-Agent strings containing Mozilla/5.0 (Windows NT 10.0; Win64; x64) LedgerChecker/1.0. The malware mutex name GlobalLedgerCheckerMutex has been observed in samples.

☠️ Risk & Impact

LedgerChecker Stealer directly exfiltrates cryptocurrency seed phrases and private keys, enabling attackers to drain wallets permanently. The primary damage is financial, with affected users losing Bitcoin, Ethereum, and other ERC-20 tokens. The malware specifically targets individuals holding significant crypto assets, with the financial sector and cryptocurrency enthusiasts being the most impacted. No data destruction or ransomware capabilities are present, but the loss of funds is irreversible.

🛡️ Mitigation

Mitigation includes verifying the authenticity of Ledger Live downloads by only using the official ledger.com URL, enabling two-factor authentication on exchange accounts, and using endpoint detection rules that flag the execution of LedgerChecker.exe or the creation of the scheduled task LedgerUpdateTask. Trend Micro’s TMME engine can detect the malware with signature TrojanSpy.Win32.LEDGERCHECKER.A. Additionally, users should monitor for unauthorized registry run keys and unfamiliar scheduled tasks.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.