Select Page

Cybersecurity researchers on Tuesday detailed as many as four different families of Brazilian banking trojans that have targeted financial institutions in Brazil, Latin America, and Europe.

Collectively called the “Tetrade” by Kaspersky researchers, the malware families — comprising Guildma, Javali, Melcoz, and Grandoreiro — have evolved their capabilities to function as a backdoor and adopt a variety of obfuscation techniques to hide its malicious activities from security software.

“Guildma, Javali, Melcoz and Grandoreiro are examples of yet another Brazilian banking group/operation that has decided to expand its attacks abroad, targeting banks in other countries,” Kaspersky said in an analysis.

“They benefit from the fact that many banks operating in Brazil also have operations elsewhere in Latin America and Europe, making it easy to extend their attacks against customers of these financial institutions.”

A Multi-Stage Malware Deployment Process

Both Guildma and Javali employ a multi-stage malware deployment process, using phishing emails as a mechanism to distribute the initial payloads.

Kaspersky found that Guildma has not only added new features and stealthiness to its campaigns since its origin in 2015, but it has also expanded to new targets beyond Brazil to attack banking users in Latin America.

A new version of the malware, for example, uses compressed email attachments (e.g., .VBS, .LNK) as an attack vector to cloak the malicious payloads or an HTML file which executes a piece of JavaScript code to download the file and fetch other modules using a legitimate command-line tool like BITSAdmin.

On top of all that, it takes advantage of NTFS Alternate Data Streams to conceal the presence of the downloaded payloads in the target systems and leverages DLL Search Order Hijacking to launch the malware binaries, only proceeding further if the environment is free of debugging and virtualisation tools.

images from Hacker News