Saturday, July 13, 2024

A Banking Trojan Called “Ursnif” Using Mouse Moments for Evasion and Decryption From Virtual Machine

Bank Trojan called “Ursnif” using clever Trick to Evade sandbox Detection from the  Virtual Machine Environment by using mouse movements.

New Futures has been embedded with it including anti-sandbox Technique to avoid Detection and its used combination of mouse position and file time stamps.

Trojan This clever Technique helps to decode the internal data and steal Data from the Thunderbird applications.

Ursnif Trojan focused on extracting contacts and passwords from the Mozilla Thunderbird email client, and its not focusing on stealing credentials for specific banks.

Ursnif spreads itself through emails provided with a plain text password for an attached encrypted document.

Also Read   Banking Trojan “Trickbot” Powered by Necurs Targeting Financial Institutions

Ursnif Delivered via Malicious Document

This Banking Trojan Delivered through email that contains an attached ZIP file within an encrypted Word document with the plain text password within the email body.

 Banking Trojan "Ursnif" Using Mouse

Malicious Spam Email with Attachment (Source : Forcepoint) 

Attached ZIP file contains 3 OLE document icons with the extension “docx. but its, not an actual word Document but it contains several obfuscated VBS files.

 Banking Trojan "Ursnif" Using MouseVB Script code has highly obfuscated and it developed to evade the sandbox Detection and its make Difficult to understand.

It will Download the Malware from the address “‘hxxp://46.17.40[.]22/hyey.pnj ”  once this Trojan triggered in the victim’s Machine.

Once Download Attempt failed , then it will initiate the second attempts that leads to Another site ‘hxxp://inshaengineeringindustries[.]com/head.pkl’.

Malicious File Execution

Downloaded Malicious files are DLL Files which contains alot of obfuscated code that evade the Static analysis Method.

According to Forcepioint, it will drop a second DLL file During execution, , map this new DLL to the current address, fix the Import Address Table and Relocation Table, then finally jump into the entry point to execute.

After complete the self check and integrity it will performing the Following task,

  • Performs anti-sandboxing checks
  • Performs anti-VM checks
  • Implements persistence through an autorun registry key
  • Injects itself into the ‘explorer.exe’ process

Once  this Trojan successfully load into the Victims , it will established the Communication with C&C server via TOR. finally it has limited  Tractability and performing  with anti-sandbox and anti-VM techniques.

Mouse-based Sandbox Technique

Malware Author used an algorithm that help to  difference between the current and previous recorded mouse coordinates to detect mouse movement and avoid sandbox environments where the mouse is not usually moved.

According to Forcepoint, It further uses the value generated by this process to ‘brute force’ its own decryption key.

First stop of the key generation,malware calculate the Delta value between the x coordinates and y Coordination of the Mouse point .

If you want to know the full technical Analysis please visit the Forcepoint Blog

An email campaign delivering the Ursnif banking Trojan which used the ‘Range’ feature within its initial HTTP requests to avoid detection which Discovered earlier time of 2016.

Also Read   Trojan Embedded Game BlazBlue Downloaded by More than Million Android Users from PlayStore


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles