Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Master Channel: The Boleto Mestre Campaign Targets Brazil

Summary: Unit 42 documented a Brazil-targeted malspam campaign it calls Boleto Mestre that has sent over 260,000 emails since June 2017, impersonating boleto payment documents to deliver an information-stealing Trojan to Windows hosts. Infected machines check in to www.petr4[.]in and then join the plain-text IRC channel #MESTRE on ssl.cheddarmcmelt[.]top, and the malware servers return nothing to visitors outside Brazil IP addresses.

Key Takeaway: The campaign kept a default-configured Windows 10 host with up-to-date Windows Defender definitions infected simply by a link click and a double-click on a downloaded VBS file, and it maintains persistence through scheduled tasks and Base64-encoded VBScript hidden in registry keys.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related