Forest Global Training Partners

Cyber Risks · Cisco Talos

Banking Trojan Attempts To Steal Brazillion$

Summary: Cisco Talos analyzed a banking trojan delivered through an HTML attachment posing as a Boleto invoice, which redirected via a goo.gl shortened URL to a RAR archive containing a malicious JAR file. The Java code installs a trojan that loads a fake vmwarebase.dll to inject code into explorer.exe or notepad.exe, and it watches foreground window titles for the names of Brazilian banks including Banco do Brasil, Bradesco, Caixa, Itau, Sicoob and Banrisul.

Why it matters: The malware abuses a trust chain in which security products that trust the first binary automatically trust the libraries it loads, letting a fake vmwarebase.dll slip past checks, a technique Talos notes PlugX has used before. Its target list is a roster of named Brazilian financial institutions, so any organization whose users bank with those brands is in scope.

Read the original at Cisco Talos ↗

Topics
Malware
Related