Saturday, February 8, 2025
HomeComputer SecurityHackers Delivering Redaman Banking Malware Disguising as a PDF Document

Hackers Delivering Redaman Banking Malware Disguising as a PDF Document

Published on

SIEM as a Service

Follow Us on Google News

A new malspam campaign delivering Redaman Banking Malware disguising as an PDF document. The Redman malware was first detected in the year 2015 and it targets customers of financial institutions in Russia.

Palo Alto Networks observed mass-distribution campaigns of Redaman in the Russian language for the last four month. The campaign primarily focuses Russian email recipients ending in ru. The file attachments are a windows executable disguised as PDF files.

The attachments are zip, 7-zip, gz and rar archives, the emails contain subject lines, message text, and attachments. Attackers use to change the attachment names constantly and referred to financial issues.

Redaman Banking Malware

Researchers found 3,845 email sessions attached with Redaman banking malware and the major senders are from Russia (3,456), Belarus (98), Ukraine (93), Estonia (29) and Germany (30).

Redaman Banking Malware

Once the Redaman Banking Malware executed it checks for the certain files or directories (cuckoo, fake_drive, Perl, strawberry, targets.xls, tsl, wget.exe, python ), if they dosen’t exists by throwing an exception, this beviour is to check it is running in sandbox or analysis environment.

If no exception occurs the executable drops a DLL in the temp directory and assigns a random file name under C:\ProgramData directory. It creates a scheduled task to make it persistent and executed everytime when users logged in.

Following are the Redaman Banking Malware Capabilities

  • Downloading files to the infected host
  • Keylogging activity
  • Capture screen shots and record video of the Windows desktop
  • Collecting and exfiltrating financial data, specifically targeting Russian banks
  • Smart card monitoring
  • Shutting down the infected host
  • Altering DNS configuration through the Windows host file
  • Retrieving clipboard data
  • Terminating running processes
  • Adding certificates to the Windows store

Once the infection completed the traffic will be sent to command and control (C2) sever and a small amount of traffic return form C2 server to the infected DLL client.

“We found over 100 examples of malspam during the last four months of 2018, and this blog provides a closer look at Redaman during that timeframe.”

Related Read

Android Released First Security updates for 2019 & Fixed 13 vulnerabilities – Update Your Phone Now

Spyware From Google Play as a Legitimate Android Apps That Infected 196 Country Users

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...

Hackers Leveraging Image & Video Attachments to Deliver Malware

Cybercriminals are increasingly exploiting image and video files to deliver malware, leveraging advanced techniques...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...