Thursday, March 28, 2024

Hackers Deliver Banking Malware Through Password Protected ZIP File

Hackers continue to employ new techniques to evade detection from antivirus and other security products. This time they started using previously reported and widely used BOM technique.

Previously Russian hacker groups used this technique to modify the hosts file on Windows systems. The Byte Order Mark additional helps the threat actor groups to stay under the radar.

kaspersky researchers detected a new campaign that depends on targeted spear phishing deliver the corrupted files to the victim’s inbox.

Infection Process

When the user tries to open the ZIP file with the default explorer it crashes and shows the following error.

ZIp
Message Showing Corrupt

“Instead of having the normal ZIP header starting with the “PK” signature (0x504B), we have three extra bytes (0xEFBBBF) that represent the Byte Order Mark (BOM) usually found within UTF-8 text files. Some tools will not recognize this file as being a ZIP archive format, but will instead recognize it as a UTF-8 text file and fail to extract the malicious payload,” reads Kaspersky blog post.

But the same files can be opened through third-party utilities such as WinRAR and 7-Zip. Once the file extracted the malware get’s executed and starts the infection process. The attack primarily targets users using third-party utilities.

ZIp
Extracted With WinRAR

The malicious executable act’s as a loader to load the main payload that embedded with the main resource section.

The malware source is a DDL with BICDAT function that is encrypted with the XOR-based algorithm. Then the library downloads the second stage of the payload which is the password-protected ZIP file.

Downloaded payload contents are encrypted with the same functions as the embedded payload. After extracting all the required files, the final payload is launched with is the Banking RAT malware.

The RAT malware looks for the following information in the affected machine.

  • Token
  • Access card code
  • Date of birth
  • Account password
  • Internet banking password
  • Electronic signature
ZIp
Banking Rat Malware

Indicators of compromise

087b2d745bc21cb1ab7feb6d3284637d
3f910715141a5bb01e082d7b940b3552
60ce805287c359d58e9afd90c308fcc8
c029b69a370e1f7b3145669f6e9399e5

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles