Friday, March 29, 2024

A Banking Trojan Called “Ursnif” Using Mouse Moments for Evasion and Decryption From Virtual Machine

Bank Trojan called “Ursnif” using clever Trick to Evade sandbox Detection from the  Virtual Machine Environment by using mouse movements.

New Futures has been embedded with it including anti-sandbox Technique to avoid Detection and its used combination of mouse position and file time stamps.

Trojan This clever Technique helps to decode the internal data and steal Data from the Thunderbird applications.

Ursnif Trojan focused on extracting contacts and passwords from the Mozilla Thunderbird email client, and its not focusing on stealing credentials for specific banks.

Ursnif spreads itself through emails provided with a plain text password for an attached encrypted document.

Also Read   Banking Trojan “Trickbot” Powered by Necurs Targeting Financial Institutions

Ursnif Delivered via Malicious Document

This Banking Trojan Delivered through email that contains an attached ZIP file within an encrypted Word document with the plain text password within the email body.

 Banking Trojan "Ursnif" Using Mouse

Malicious Spam Email with Attachment (Source : Forcepoint) 

Attached ZIP file contains 3 OLE document icons with the extension “docx. but its, not an actual word Document but it contains several obfuscated VBS files.

 Banking Trojan "Ursnif" Using MouseVB Script code has highly obfuscated and it developed to evade the sandbox Detection and its make Difficult to understand.

It will Download the Malware from the address “‘hxxp://46.17.40[.]22/hyey.pnj ”  once this Trojan triggered in the victim’s Machine.

Once Download Attempt failed , then it will initiate the second attempts that leads to Another site ‘hxxp://inshaengineeringindustries[.]com/head.pkl’.

Malicious File Execution

Downloaded Malicious files are DLL Files which contains alot of obfuscated code that evade the Static analysis Method.

According to Forcepioint, it will drop a second DLL file During execution, , map this new DLL to the current address, fix the Import Address Table and Relocation Table, then finally jump into the entry point to execute.

After complete the self check and integrity it will performing the Following task,

  • Performs anti-sandboxing checks
  • Performs anti-VM checks
  • Implements persistence through an autorun registry key
  • Injects itself into the ‘explorer.exe’ process

Once  this Trojan successfully load into the Victims , it will established the Communication with C&C server via TOR. finally it has limited  Tractability and performing  with anti-sandbox and anti-VM techniques.

Mouse-based Sandbox Technique

Malware Author used an algorithm that help to  difference between the current and previous recorded mouse coordinates to detect mouse movement and avoid sandbox environments where the mouse is not usually moved.

According to Forcepoint, It further uses the value generated by this process to ‘brute force’ its own decryption key.

First stop of the key generation,malware calculate the Delta value between the x coordinates and y Coordination of the Mouse point .

If you want to know the full technical Analysis please visit the Forcepoint Blog

An email campaign delivering the Ursnif banking Trojan which used the ‘Range’ feature within its initial HTTP requests to avoid detection which Discovered earlier time of 2016.

Also Read   Trojan Embedded Game BlazBlue Downloaded by More than Million Android Users from PlayStore

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles