Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Banload Malware Affecting Brazil Exhibits Unusually Complex Infection Process

Summary: Unit 42 analyzed Banload samples targeting Brazilian systems that use a multi-stage infection chain orchestrated by an encrypted AutoIt script, beginning with an executable attached to phishing emails with the Portuguese subject line "Seu Pedido foi enviado pelo vendedor." The script downloads four files from compra-da-sorte[.]com - a copy of the 7zip utility and three password-protected archives unzipped with passwords "102030as" and "405060" - then drops a CPL file, injects an MZP executable compiled in September 2015 into a suspended IExplore process, and writes a Delphi DLL named procc.dll to the Templates directory.

Bottom line: Because each stage is modular and password-encrypted, static inspection of individual components can return benign verdicts and false negatives - only the full chain produces malicious activity, so a scanner that clears one piece has cleared nothing. Unit 42 also notes the volume of samples and configurations suggests an automated building system, with most recent samples sent from hosts in Germany to hosts in Brazil.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related