Skip to main content

Four Different Banking Malwares Now Trying to Rob Users Worldwide.


Brazilian Banking Trojans
Cybersecurity researchers on Tuesday 14-July-2020, detailed as many as four different families of Brazilian banking trojans that have targeted financial institutions in Brazil, Latin America, and Europe.

https://www.facebook.com/1829407613953796

Collectively called the "Tetrade" by Kaspersky researchers, the malware families — comprising Guildma, Javali, Melcoz, and Grandoreiro — have evolved their capabilities to function as a backdoor and adopt a variety of obfuscation techniques to hide its malicious activities from security software.

"Guildma, Javali, Melcoz and Grandoreiro are examples of yet another Brazilian banking group/operation that has decided to expand its attacks abroad, targeting banks in other countries," Kaspersky said in an analysis.

"They benefit from the fact that many banks operating in Brazil also have operations elsewhere in Latin America and Europe, making it easy to extend their attacks against customers of these financial institutions."

A Multi-Stage Malware Deployment Process.


Both Guildma and Javali employ a multi-stage malware deployment process, using phishing emails as a mechanism to distribute the initial payloads.

Kaspersky found that Guildma has not only added new features and stealthiness to its campaigns since its origin in 2015, but it has also expanded to new targets beyond Brazil to attack banking users in Latin America.

A new version of the malware, for example, uses compressed email attachments (e.g., .VBS, .LNK) as an attack vector to cloak the malicious payloads or an HTML file which executes a piece of JavaScript code to download the file and fetch other modules using a legitimate command-line tool like BITSAdmin.

On top of all that, it takes advantage of NTFS Alternate Data Streams to conceal the presence of the downloaded payloads in the target systems and leverages DLL Search Order Hijacking to launch the malware binaries, only proceeding further if the environment is free of debugging and virtualization tools.

Brazilian Banking Trojans

"In order to execute the additional modules, the malware uses the process hollowing technique for hiding the malicious payload inside a whitelisted process, such as svchost.exe," Kaspersky said. These modules are downloaded from an attacker-controlled server, whose information is stored in Facebook and YouTube pages in an encrypted format.

Once installed, the final payload monitors for specific bank websites, which, when opened, triggers a cascade of operations that allow the cybercriminals to perform any financial transaction using the victim's computer.

Javali (active since November 2017), similarly, downloads payloads sent via emails to fetch a final-stage malware from a remote C2 that's capable of stealing financial and login information from users in Brazil and Mexico who are visiting cryptocurrency websites (Bittrex) or payment solutions (Mercado Pago).

Stealing Passwords and Bitcoin Wallets


Melcoz, a variant of the open-source RAT Remote Access PC, has been linked to a string of attacks in Chile and Mexico since 2018, with the malware having the ability to pilfer passwords from clipboard, browsers, and Bitcoin wallets by replacing original wallet information with a dubious alternative owned by the adversaries.

It makes use of VBS scripts in installer package files (.MSI) to download the malware on the system and subsequently abuses AutoIt interpreter and VMware NAT service to load the malicious DLL on the target system.

"The malware enables the attacker to display an overlay window in front of the victim's browser to manipulate the user's session in the background," the researchers said. "In this way, the fraudulent transaction is performed from the victim's machine, making it harder to detect for anti-fraud solutions on the bank's end."

Furthermore, a threat actor can also request specific information that's asked during a bank transaction, such as a one-time password, thereby bypassing two-factor authentication.

banking malware

And lastly, Grandoreiro has been tracked to a campaign spread across Brazil, Mexico, Portugal, and Spain since 2016, enabling attackers to perform fraudulent banking transactions by using the victims' computers for circumventing security measures used by banks.

The malware itself is hosted on Google Sites pages and delivered via compromised websites and Google Ads or spear-phishing methods, in addition to using Domain Generation Algorithm (DGA) for hiding the C2 address used during the attack.

"Brazilian crooks are rapidly creating an ecosystem of affiliates, recruiting cybercriminals to work with in other countries, adopting MaaS (malware-as-a-service) and quickly adding new techniques to their malware as a way to keep it relevant and financially attractive to their partners," Kaspersky concluded.

"As a threat, these banking trojan families try to innovate by using DGA, encrypted payloads, process hollowing, DLL hijacking, a lot of LoLBins, fileless infections and other tricks as a way of obstructing analysis and detection. We believe that these threats will evolve to target more banks in more countries."



THN



#osutayusuf

Comments

Popular posts from this blog

We Bring You Brief Series of Sanctions Against Uganda Government Officials.

📸: Gen Abel Kandiho. On 9-December-2021, USA slapped sanctions against the then CMI Commander Gen Abel Kandiho. 📸: Gen Kale Kayihura. On 9-December-2022, UK slapped sanctions against former Police Boss Gen Kale Kayihura. 📸: Commissioner General of Prisons, Johnson Byabashaija. Again on this 4-December-2023, the same USA has slapped sanctions against Uganda Prisons Commander Johnson Byabashaija over alleged torture and human rights abuses in Prisons across Uganda. We ask, has USA and UK made December as an LCM to slap sanctions against high ranking government officials in Uganda even when the sanctions just remain on paper without deeper investigations to ascertain logical conclusions or remedy to that effect ?. #iip_updates  #Information_is_Power  #we_inform_the_uninformed

How to Host a Website for Free From Your PC or Laptop.

Why pay for a web hosting service when your old computer can do the same thing? Learn how to self-host your site. If you're planning to launch a website but don't want to pay recurring monthly or annual hosting fees, you can use any old laptop or desktop PC to host a website for free. It's a great way to utilize your old system instead of throwing it away. In this guide, we will install and set up services on our 10-year-old laptop to host a WordPress, Joomla, or custom HTML or PHP-based website with a free SSL certificate. MAKEUSEOF VIDEO OF THE DAY Things You Will Need to Host a Website Following are the pre-requisites to host a website for free from home with just your computer: An old laptop or PC running Ubuntu Server. A registered domain name for your website Ethernet cable to connect the laptop or PC to router for reliable and fast connection Step 1: Update and Upgrade the Packages After  installing Ubuntu Server on your computer , execute the following c...

WHERE IS MINISTER OF SEX SIMON LOKODO?. (He deserves a battle of soda from me! Ministe`r esalanga mabee. He is quick to run after Mrs Dr Stella Nyanzi and other Opposition elements. Government aza aza edo zuu vaa kpere bua). Anyway, below is the article! POLICE OFFICER AKOL ESTHER CHARGED OF BEING A PUBLIC NUISANCE Naughty Officer Officer who embarrassed police after leaking nude photo charged 13.03.2018 She serves in the 'Very Important Persons Protection Unit'  Akol Esther  (Courtesy) A female police officer whose nude photo surfaced on social media has been charged of being a public nuisance. Akol Esther serves in the Very Important Persons Protection Unit (VIPPU) of the police force. Kampala Metropolitan Police spokesperson Luke Owoyesigire says Akol Esther might be demoted or expelled from the police force if found guilty of circulating nude photos. Police court is yet to announce date when Akol Esther is expected to appear for a hearing. This comes at a time when Pornography Control Committee is taking tough measures against persons circulating pornography content. The committee warned and promised to arrest persons who will circulate pornographic content.

POLICE OFFICER AKOL ESTHER CHARGED OF BEING A PUBLIC NUISANCE Naughty Officer Officer who embarrassed police after leaking nude photo charged 13.03.2018 She serves in the 'Very Important Persons Protection Unit' Akol Esther  (Courtesy) A female police officer whose nude photo surfaced on social media has been charged of being a public nuisance. Akol Esther serves in the Very Important Persons Protection Unit (VIPPU) of the police force. Kampala Metropolitan Police spokesperson Luke Owoyesigire says  Akol Esther might be demoted or expelled from the police force if found guilty of circulating nude photos . Police court is yet to announce date when Akol Esther is expected to appear for a hearing. This comes at a time when Pornography Control Committee is taking tough measures against persons circulating pornography content. The committee warned and promised to arrest persons who will circulate pornographic content.