Wednesday, April 17, 2024

Hackers Deliver Banking Malware Through Password Protected ZIP File

Hackers continue to employ new techniques to evade detection from antivirus and other security products. This time they started using previously reported and widely used BOM technique.

Previously Russian hacker groups used this technique to modify the hosts file on Windows systems. The Byte Order Mark additional helps the threat actor groups to stay under the radar.

kaspersky researchers detected a new campaign that depends on targeted spear phishing deliver the corrupted files to the victim’s inbox.

Infection Process

When the user tries to open the ZIP file with the default explorer it crashes and shows the following error.

Message Showing Corrupt

“Instead of having the normal ZIP header starting with the “PK” signature (0x504B), we have three extra bytes (0xEFBBBF) that represent the Byte Order Mark (BOM) usually found within UTF-8 text files. Some tools will not recognize this file as being a ZIP archive format, but will instead recognize it as a UTF-8 text file and fail to extract the malicious payload,” reads Kaspersky blog post.

But the same files can be opened through third-party utilities such as WinRAR and 7-Zip. Once the file extracted the malware get’s executed and starts the infection process. The attack primarily targets users using third-party utilities.

Extracted With WinRAR

The malicious executable act’s as a loader to load the main payload that embedded with the main resource section.

The malware source is a DDL with BICDAT function that is encrypted with the XOR-based algorithm. Then the library downloads the second stage of the payload which is the password-protected ZIP file.

Downloaded payload contents are encrypted with the same functions as the embedded payload. After extracting all the required files, the final payload is launched with is the Banking RAT malware.

The RAT malware looks for the following information in the affected machine.

  • Token
  • Access card code
  • Date of birth
  • Account password
  • Internet banking password
  • Electronic signature
Banking Rat Malware

Indicators of compromise


You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.


Latest articles

LightSpy Hackers Target Indian Apple Device Users To Steal Sensitive Data

Hackers target Apple device users because they are perceived to be of higher social...

Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients

In today's digital landscape, email security has become a critical concern for businesses of...

Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group

In a digital age where information is the new currency, the recent global hack...

Ex-Security Engineer Jailed For Hacking Decentralized Cryptocurrency Exchanges

Ahmed exploited a vulnerability in a decentralized cryptocurrency exchange's smart contract by injecting fabricated...

Omni Hotels & Resorts Hack: Attackers have Stolen Customer Information

Omni Hotels & Resorts has revealed that it was the target of a recent...

Connect:fun Attacking Organizations Running Fortinet’s FortiClient EMS

A new exploit campaign has emerged, targeting organizations that utilize Fortinet’s FortiClient EMS.Dubbed...

TA558 Hackers Compromised 320+ Organizations’ FTP & SMTP Servers

TA558, a financially motivated threat actor identified in 2018, is targeting several countries but...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles