MnuBot – New Banking Trojan Take Browsers Screenshots, Keylogging to Steal Bank Data

Newly discovered banking Trojan named MnuBot malware spreading to steal the sensitive bank related information such as login credentials through taking the screenshot of the browser window and set the keylogger in victims machine.

MnuBot malware using  Microsoft SQL Server as a communication medium and take the commands from C&C server and execute it into the victim’s machine.

MnuBot Malware authors who belong to Brazilian region are using the various technique to evade the detection and they are tried to hide their malicious network through innocent Microsoft SQL traffic.

MnuBot malware mainly targets bank website and it will steal the banking data Once the user has an open browsing session to his banking website account and later the malware will be downloaded and the malware gets into the browser session.

To achieve the stealing operation, this malware opens the browser session and take the screenshot, set the keylogger into the vicitms machine, Simulating user clicks and keystrokes.

According to securityintelligence, MnuBot uses a full-screen overlay form to assist the attacker to commit the fraud. Overlaying forms are used to prevent the victims from accessing their open banking session inside the browser.

“Those forms are a type of social engineering to keep the user waiting. In the background, the cybercriminal takes control over the user endpoint and attempts to perform an illegal transaction via the victim’s open banking session.”

How does MnuBot Malware Works

MnuBot performing the infection with 2 stages of Attack flow, In the first stage it looking for  Desk.txt file within the AppData Roaming folder.

Desk.txt file is using this malware to identify the currently running desktop in with the victim’s machine.

if the malware doesn’t find the Desk.txt file, then it creates the file, creates a new desktop and switches the user workspace to that newly created desktop and this new desktop will run along the side of the victim current desktop.

MnuBot runs inside the newly created desktop

Later, it keeps checking the legitimate user opened windows and waiting for the bank names that it have within its configuration and once it finds the relevant bank name then it will query the server for the second stage executable according to the bank name that was found.

At the second stage, the Trojan executes the downloaded MnuBot payload to steal the banking details which is opened by victims in their desktop, then the malware record the screen, take a screenshot, set keylogging to collect the various sensitive banking data.

Later on, MnuBot malware connects to the command & control server and uses SQL server details (server address, port, username and a password) to share the collected information with the attacker.

Also Read:

Android Spyware & Banking Trojan Attack via DNS Spoofing that Poses as Legitimate Facebook or Chrome App

New Banking Trojan IcedID Evade Sandboxes and Performing Web Injection Attacks

Banking Trojan “BankBot” Infected More Than 150 Play Store Apps to Steal Bank Details

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

C2A Security’s EVSec Risk Management and Automation Platform Gains Automotive Industry Favor as Companies Pursue Regulatory Compliance

In 2023, C2A Security added multiple OEMs and Tier 1s to its portfolio of customers, successful evaluations, and partnerships such…

48 mins ago

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and education. The latest update, Wireshark 4.2.4,…

3 hours ago

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered platform designed to redefine how we…

3 hours ago

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information and grant unauthorized access. It's an…

4 hours ago

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including two zero-day exploits showcased at the…

7 hours ago

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and turning them into bots for the…

7 hours ago