Saturday, July 13, 2024
EHA

Hackers Deliver Banking Malware Through Password Protected ZIP File

Hackers continue to employ new techniques to evade detection from antivirus and other security products. This time they started using previously reported and widely used BOM technique.

Previously Russian hacker groups used this technique to modify the hosts file on Windows systems. The Byte Order Mark additional helps the threat actor groups to stay under the radar.

kaspersky researchers detected a new campaign that depends on targeted spear phishing deliver the corrupted files to the victim’s inbox.

Infection Process

When the user tries to open the ZIP file with the default explorer it crashes and shows the following error.

ZIp
Message Showing Corrupt

“Instead of having the normal ZIP header starting with the “PK” signature (0x504B), we have three extra bytes (0xEFBBBF) that represent the Byte Order Mark (BOM) usually found within UTF-8 text files. Some tools will not recognize this file as being a ZIP archive format, but will instead recognize it as a UTF-8 text file and fail to extract the malicious payload,” reads Kaspersky blog post.

But the same files can be opened through third-party utilities such as WinRAR and 7-Zip. Once the file extracted the malware get’s executed and starts the infection process. The attack primarily targets users using third-party utilities.

ZIp
Extracted With WinRAR

The malicious executable act’s as a loader to load the main payload that embedded with the main resource section.

The malware source is a DDL with BICDAT function that is encrypted with the XOR-based algorithm. Then the library downloads the second stage of the payload which is the password-protected ZIP file.

Downloaded payload contents are encrypted with the same functions as the embedded payload. After extracting all the required files, the final payload is launched with is the Banking RAT malware.

The RAT malware looks for the following information in the affected machine.

  • Token
  • Access card code
  • Date of birth
  • Account password
  • Internet banking password
  • Electronic signature
ZIp
Banking Rat Malware

Indicators of compromise

087b2d745bc21cb1ab7feb6d3284637d
3f910715141a5bb01e082d7b940b3552
60ce805287c359d58e9afd90c308fcc8
c029b69a370e1f7b3145669f6e9399e5

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Website

Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles