Friday, March 29, 2024

MnuBot – New Banking Trojan Take Browsers Screenshots, Keylogging to Steal Bank Data

Newly discovered banking Trojan named MnuBot malware spreading to steal the sensitive bank related information such as login credentials through taking the screenshot of the browser window and set the keylogger in victims machine.

MnuBot malware using  Microsoft SQL Server as a communication medium and take the commands from C&C server and execute it into the victim’s machine.

MnuBot Malware authors who belong to Brazilian region are using the various technique to evade the detection and they are tried to hide their malicious network through innocent Microsoft SQL traffic.

MnuBot malware mainly targets bank website and it will steal the banking data Once the user has an open browsing session to his banking website account and later the malware will be downloaded and the malware gets into the browser session.

To achieve the stealing operation, this malware opens the browser session and take the screenshot, set the keylogger into the vicitms machine, Simulating user clicks and keystrokes.

According to securityintelligence, MnuBot uses a full-screen overlay form to assist the attacker to commit the fraud. Overlaying forms are used to prevent the victims from accessing their open banking session inside the browser.

“Those forms are a type of social engineering to keep the user waiting. In the background, the cybercriminal takes control over the user endpoint and attempts to perform an illegal transaction via the victim’s open banking session.”

How does MnuBot Malware Works

MnuBot performing the infection with 2 stages of Attack flow, In the first stage it looking for  Desk.txt file within the AppData Roaming folder.

Desk.txt file is using this malware to identify the currently running desktop in with the victim’s machine.

if the malware doesn’t find the Desk.txt file, then it creates the file, creates a new desktop and switches the user workspace to that newly created desktop and this new desktop will run along the side of the victim current desktop.

MnuBot runs inside the newly created desktop

Later, it keeps checking the legitimate user opened windows and waiting for the bank names that it have within its configuration and once it finds the relevant bank name then it will query the server for the second stage executable according to the bank name that was found.

At the second stage, the Trojan executes the downloaded MnuBot payload to steal the banking details which is opened by victims in their desktop, then the malware record the screen, take a screenshot, set keylogging to collect the various sensitive banking data.

Later on, MnuBot malware connects to the command & control server and uses SQL server details (server address, port, username and a password) to share the collected information with the attacker.

Also Read:

Android Spyware & Banking Trojan Attack via DNS Spoofing that Poses as Legitimate Facebook or Chrome App

New Banking Trojan IcedID Evade Sandboxes and Performing Web Injection Attacks

Banking Trojan “BankBot” Infected More Than 150 Play Store Apps to Steal Bank Details

Website

Latest articles

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles