Saturday, April 13, 2024

MnuBot – New Banking Trojan Take Browsers Screenshots, Keylogging to Steal Bank Data

Newly discovered banking Trojan named MnuBot malware spreading to steal the sensitive bank related information such as login credentials through taking the screenshot of the browser window and set the keylogger in victims machine.

MnuBot malware using  Microsoft SQL Server as a communication medium and take the commands from C&C server and execute it into the victim’s machine.

MnuBot Malware authors who belong to Brazilian region are using the various technique to evade the detection and they are tried to hide their malicious network through innocent Microsoft SQL traffic.

MnuBot malware mainly targets bank website and it will steal the banking data Once the user has an open browsing session to his banking website account and later the malware will be downloaded and the malware gets into the browser session.

To achieve the stealing operation, this malware opens the browser session and take the screenshot, set the keylogger into the vicitms machine, Simulating user clicks and keystrokes.

According to securityintelligence, MnuBot uses a full-screen overlay form to assist the attacker to commit the fraud. Overlaying forms are used to prevent the victims from accessing their open banking session inside the browser.

“Those forms are a type of social engineering to keep the user waiting. In the background, the cybercriminal takes control over the user endpoint and attempts to perform an illegal transaction via the victim’s open banking session.”

How does MnuBot Malware Works

MnuBot performing the infection with 2 stages of Attack flow, In the first stage it looking for  Desk.txt file within the AppData Roaming folder.

Desk.txt file is using this malware to identify the currently running desktop in with the victim’s machine.

if the malware doesn’t find the Desk.txt file, then it creates the file, creates a new desktop and switches the user workspace to that newly created desktop and this new desktop will run along the side of the victim current desktop.

MnuBot runs inside the newly created desktop

Later, it keeps checking the legitimate user opened windows and waiting for the bank names that it have within its configuration and once it finds the relevant bank name then it will query the server for the second stage executable according to the bank name that was found.

At the second stage, the Trojan executes the downloaded MnuBot payload to steal the banking details which is opened by victims in their desktop, then the malware record the screen, take a screenshot, set keylogging to collect the various sensitive banking data.

Later on, MnuBot malware connects to the command & control server and uses SQL server details (server address, port, username and a password) to share the collected information with the attacker.

Also Read:

Android Spyware & Banking Trojan Attack via DNS Spoofing that Poses as Legitimate Facebook or Chrome App

New Banking Trojan IcedID Evade Sandboxes and Performing Web Injection Attacks

Banking Trojan “BankBot” Infected More Than 150 Play Store Apps to Steal Bank Details

Website

Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles