Exploring the Latest Mispadu Stealer Variant
Summary: Unit 42 researchers discovered a new variant of Mispadu Stealer, a Delphi-written banking Trojan first reported in 2019, while hunting for exploitation of the Windows SmartScreen bypass CVE-2023-36025. The samples, compiled before the CVE was published, use crafted .url files pointing to a threat actor's network share over WebDAV to execute a malicious binary, and target 15 URL groupings tied to Mexican financial institutions, exchanges and cryptocurrency organizations.
Bottom line: The malware checks the victim's time zone offset and exits unless the result falls in a range covering most of the Americas and parts of Western Europe, and it queries browser history for URLs visited after Aug. 29, 2023 - meaning the campaign was already running and collecting data before the vulnerability it is now associated with was public.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Mentions
- CVE-2023-36025
- Related
- CVE-2023-36025: Microsoft Windows Smart Screen Security Feature Bypass Vulnerability Known Exploited Vulnerabilities · Nov 14, 2023Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days Cyber Risks ·Microsoft Patch Tuesday, November 2023 Edition Cyber Risks ·