A new malspam campaign delivering Redaman Banking Malware disguising as an PDF document. The Redman malware was first detected in the year 2015 and it targets customers of financial institutions in Russia.
Palo Alto Networks observed mass-distribution campaigns of Redaman in the Russian language for the last four month. The campaign primarily focuses Russian email recipients ending in ru. The file attachments are a windows executable disguised as PDF files.
The attachments are zip, 7-zip, gz and rar archives, the emails contain subject lines, message text, and attachments. Attackers use to change the attachment names constantly and referred to financial issues.
Researchers found 3,845 email sessions attached with Redaman banking malware and the major senders are from Russia (3,456), Belarus (98), Ukraine (93), Estonia (29) and Germany (30).
Once the Redaman Banking Malware executed it checks for the certain files or directories (cuckoo, fake_drive, Perl, strawberry, targets.xls, tsl, wget.exe, python ), if they dosen’t exists by throwing an exception, this beviour is to check it is running in sandbox or analysis environment.
If no exception occurs the executable drops a DLL in the temp directory and assigns a random file name under C:\ProgramData directory. It creates a scheduled task to make it persistent and executed everytime when users logged in.
Following are the Redaman Banking Malware Capabilities
Once the infection completed the traffic will be sent to command and control (C2) sever and a small amount of traffic return form C2 server to the infected DLL client.
“We found over 100 examples of malspam during the last four months of 2018, and this blog provides a closer look at Redaman during that timeframe.”
Android Released First Security updates for 2019 & Fixed 13 vulnerabilities – Update Your Phone Now
Spyware From Google Play as a Legitimate Android Apps That Infected 196 Country Users
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…