Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Malspam Targeting Brazil Continues to Evolve

Summary: Unit 42 identified 9,215 samples tagged "Banload" in AutoFocus since December 2013, including 2,132 in the first six months of 2017, in a Brazilian malspam campaign that abuses Google URL Shortener and Dropbox across a multi-stage infection chain. A late-June 2017 message posing as a third and final IPTU tax notice from City Hall came from an Italian IP address (212.237.35.135), used a spoofed sender address matching the recipient, and delivered a zip archive whose LNK file used the Squiblydoo technique via regsvr32.exe to side-load a malicious fltLib.dll alongside a legitimate G-Buster GbpSv.exe.

Bottom line: Post-infection traffic returned data on more than 400 infected Windows computers, mostly in Brazil but also in Argentina, the Czech Republic, and Russia - and the payload hid behind a signed executable that most antivirus products will not flag.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related