MnuBot – New Banking Trojan Take Browsers Screenshots, Keylogging to Steal Bank Data

Newly discovered banking Trojan named MnuBot malware spreading to steal the sensitive bank related information such as login credentials through taking the screenshot of the browser window and set the keylogger in victims machine.

MnuBot malware using  Microsoft SQL Server as a communication medium and take the commands from C&C server and execute it into the victim’s machine.

MnuBot Malware authors who belong to Brazilian region are using the various technique to evade the detection and they are tried to hide their malicious network through innocent Microsoft SQL traffic.

MnuBot malware mainly targets bank website and it will steal the banking data Once the user has an open browsing session to his banking website account and later the malware will be downloaded and the malware gets into the browser session.

To achieve the stealing operation, this malware opens the browser session and take the screenshot, set the keylogger into the vicitms machine, Simulating user clicks and keystrokes.

According to securityintelligence, MnuBot uses a full-screen overlay form to assist the attacker to commit the fraud. Overlaying forms are used to prevent the victims from accessing their open banking session inside the browser.

“Those forms are a type of social engineering to keep the user waiting. In the background, the cybercriminal takes control over the user endpoint and attempts to perform an illegal transaction via the victim’s open banking session.”

How does MnuBot Malware Works

MnuBot performing the infection with 2 stages of Attack flow, In the first stage it looking for  Desk.txt file within the AppData Roaming folder.

Desk.txt file is using this malware to identify the currently running desktop in with the victim’s machine.

if the malware doesn’t find the Desk.txt file, then it creates the file, creates a new desktop and switches the user workspace to that newly created desktop and this new desktop will run along the side of the victim current desktop.

Later, it keeps checking the legitimate user opened windows and waiting for the bank names that it have within its configuration and once it finds the relevant bank name then it will query the server for the second stage executable according to the bank name that was found.

At the second stage, the Trojan executes the downloaded MnuBot payload to steal the banking details which is opened by victims in their desktop, then the malware record the screen, take a screenshot, set keylogging to collect the various sensitive banking data.

Later on, MnuBot malware connects to the command & control server and uses SQL server details (server address, port, username and a password) to share the collected information with the attacker.

Also Read:

Android Spyware & Banking Trojan Attack via DNS Spoofing that Poses as Legitimate Facebook or Chrome App

New Banking Trojan IcedID Evade Sandboxes and Performing Web Injection Attacks

Banking Trojan “BankBot” Infected More Than 150 Play Store Apps to Steal Bank Details