Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Russian Language Malspam Pushing Redaman Banking Malware

Summary: Unit 42 tracked Russian-language malspam distributing Redaman banking malware from September through December 2018, with attachments shifting from zip archives in September to gzip files by December, all disguised as PDF documents tied to an alleged financial issue. AutoFocus recorded 3,845 email sessions with Redaman-tagged attachments in that window, and analysis of a November 13 sample showed the executable checks for sandbox artifacts, drops a DLL into AppData\Local\Temp, persists it via a scheduled task, and pulls a Pony variant DLL from a C2 server at 185.141.61[.]246.

What's compelling: The malware resolves its next-stage infrastructure through namecha[.]in, a Namecoin block explorer used for decentralized DNS, so blocking the C2 IP alone leaves the lookup path intact. With 3,845 email sessions in four months aimed at recipients transacting with Russian financial institutions, the delivery mechanism is a document-themed attachment that changes archive format month to month.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related