Hackers Deliver Banking Malware Through Password Protected ZIP File

Hackers continue to employ new techniques to evade detection from antivirus and other security products. This time they started using previously reported and widely used BOM technique.

Previously Russian hacker groups used this technique to modify the hosts file on Windows systems. The Byte Order Mark additional helps the threat actor groups to stay under the radar.

kaspersky researchers detected a new campaign that depends on targeted spear phishing deliver the corrupted files to the victim’s inbox.

Infection Process

When the user tries to open the ZIP file with the default explorer it crashes and shows the following error.

“Instead of having the normal ZIP header starting with the “PK” signature (0x504B), we have three extra bytes (0xEFBBBF) that represent the Byte Order Mark (BOM) usually found within UTF-8 text files. Some tools will not recognize this file as being a ZIP archive format, but will instead recognize it as a UTF-8 text file and fail to extract the malicious payload,” reads Kaspersky blog post.

But the same files can be opened through third-party utilities such as WinRAR and 7-Zip. Once the file extracted the malware get’s executed and starts the infection process. The attack primarily targets users using third-party utilities.

The malicious executable act’s as a loader to load the main payload that embedded with the main resource section.

The malware source is a DDL with BICDAT function that is encrypted with the XOR-based algorithm. Then the library downloads the second stage of the payload which is the password-protected ZIP file.

Downloaded payload contents are encrypted with the same functions as the embedded payload. After extracting all the required files, the final payload is launched with is the Banking RAT malware.

The RAT malware looks for the following information in the affected machine.

• Token
• Access card code
• Date of birth
• Account password
• Internet banking password
• Electronic signature

Indicators of compromise

087b2d745bc21cb1ab7feb6d3284637d
 3f910715141a5bb01e082d7b940b3552
 60ce805287c359d58e9afd90c308fcc8
 c029b69a370e1f7b3145669f6e9399e5

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.