Back to overview

Threat intelligence

New Banker Trojan targeting Brazilian government site (June 28, 2013)

by Security News

The Dell SonicWALL Threats Research team came across a new Banker Trojan targeting a Brazilian Government Department of Treasury owned electronic invoice website, attempting to steal sensitive user information. The Trojan arrives as a Windows Control Panel Item file and is a UPX packed DLL written in Delphi. It pretends to be a proof of NF-e invoice and executes if the user attempts to open it.

Infection Cycle:

Upon execution, the Trojan checks for the presence of VMWare environment and terminates if detected.

It connects to a remote server in Brazil grupomasterplan.com.br to download multiple malicious executables in an encrypted format. The downloaded files are disguised as JPEG images as seen below:

  • GET /IMAGE(REMOVED)/m.jpg
  • GET /IMAGE(REMOVED)/u.jpg
  • GET /IMAGE(REMOVED)/d.jpg

The following files are dropped on the infected system:

  • %Windows%5xpg93.exe
  • %Windows%vj0yn.b1rf5th5
  • C:2013
  • %USERPROFILE%Start MenuProgramsStartupf7xnd6.LNK

The Trojan installs multiple hooks and launches the Brazilian Government Department of Treasury owned website in Internet Explorer as seen below:

Site description in english (Courtesy: Google Translation):

If the user enters the Access-Key and Access-Code information, even though this is the official government website the access information will be compromised because of the hooks installed:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

  • GAV: Banload.SEE (Trojan)
  • GAV: Banker.ZRG (Trojan)
  • GAV: Banload.SSE#enc (Trojan)
  • GAV: Symmi.L_2 (Trojan)

Share This Article

An Article By

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.