Forest Global Training Partners

Cyber Risks · Cisco Talos

Neurevt trojan takes aim at Mexican users

Summary: Cisco Talos reports that recent Neurevt trojan samples in Cisco Secure Endpoint combine the trojan with backdoors and information stealers, and that the campaigns appear to target Mexican organizations, with droppers embedding URLs belonging to many major banks in Mexico. The chain begins with an obfuscated PowerShell command that downloads a first-stage executable from saltoune[.]xyz (created June 21, 2021, registered with NameCheap, serving IP 162[.]213[.]251[.]176), which drops files, sets persistence and Internet Explorer ZoneMap registry keys, and unpacks a password-protected RAR to launch a second stage that injects into explorer.exe and communicates with C2 domains russk18[.]icu and moscow13[.]at via HTTP POST.

Bottom line: The PE file contains functions built to access the webpage panels and textboxes of Mexican banking sites to steal credentials and 2FA tokens, so an infection here converts directly into account takeover at named banks. Talos also notes the malware steals service tokens to elevate privilege, disables the firewall, and deletes the mark-of-the-web from downloaded files - meaning the endpoint's own protections are being turned off from inside.

Read the original at Cisco Talos ↗

Topics
Malware
Related