According to reports, a malware known as Grandoriero has infected banking applications and websites in over 60 countries, and investigation reveals that more than 41 banking applications in Nigeria has been infected.
Grandoreiro’s attack method includes obtaining email addresses from affected systems and sending out more phishing emails through the Microsoft Outlook client. Cybercriminals could use the software to gather sensitive financial data, potentially resulting in financial losses.
How the Malware is Spread
The Grandoreiro banking Trojan which is likely operated as a Malware-as-a-Service (MaaS) is spread through large-scale phishing campaigns, where cyber criminals send emails impersonating government entities and financial institutions. These emails entice recipients to click on links to view documents such as invoice, account statements, make a payment, leading to the download of a ZIP file containing a loader executable.
The loader is designed to evade automatic antivirus scan by increasing it’s size to more than 100MB and In hopes of circumventing automated execution, it displays a small CAPTCHA pop-up imitating Adobe PDF reader, which requires a click to continue with the execution. Once executed, the loader checks the environment to avoid sandboxes or unprotected Windows 7 machines and collects victim data such as computer and user names, operating system version, antivirus name, public IP address, and running processes.
This information collected is encrypted and sent to a command & control (C2) server. The malware also checks for Microsoft Outlook clients, crypto wallets, and specific banking security products. To ensure persistence, the malware modifies the Windows registry and uses a Domain Generation Algorithm (DGA) for C2 communication. It harvests email addresses from Outlook, sending further phishing emails from the victim’s account after disabling Outlook alerts. It avoids collecting certain email addresses like those with “noreply” or “newsletter” and scans victim folders for files with specific extensions to find more addresses. The malware sends spam emails based on templates from its C2 server, ensuring the emails are sent when the user is inactive for a certain period, and immediately deletes all the sent emails from the victim’s mailbox.
Besides its banking trojan capabilities, the malware allows cybercriminals to control the infected computer, perform keylogging, manage windows and processes, open a browser and execute JavaScript, upload or download files, and send emails.
The following are consequences of installing this banking malware:
- Compromised systems and banking applications.
- Theft of sensitive data.
- It can spread through infected victim inboxes via email.
- Financial fraud through compromised systems.
- Invasion of privacy.
- Denial of Service (DoS) attack.
- Identity theft.
Recommendations and preventive measures to avoid getting infected by this maware
- Avoid opening suspicious emails that prompts you to download files or requests for your sensitive information.
- Verify the sender’s authenticity before clicking on any link or downloading attachments.
- Download software and applications from official websites and direct download links.
- Update installed programs through in-built update functionality or tools provided by the official software developers.
- Regularly scan your computers for threats with a reputable antivirus or anti-spyware software and always keep this software up to date.
- Install and configure robust system security solutions that can detect and block malicious activities
- Monitor network traffic for unusual activity, such as multiple consecutive requests to IP geolocation services like http://ip-api.com/json, which could indicate an infection.
- Block known malicious domains and pre-calculated DGA domains at the DNS level to prevent the malware from communicating with its C2 servers.
- Educate employees about phishing tactics and the importance of cyber security hygiene.
- Regularly check Windows registry keys used for persistence, such as HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
Definition of Key Terms:
CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart): A type of challenge-response test used in computing to determine whether the user is human or not.
Malware: Short for “malicious software,” malware is any software intentionally designed to cause damage to devices (computer, Smartphones etc) or network. It includes viruses, worms, trojan horses, ransomware, spyware, adware, and other malicious programs.
Malware-as-a-Service (MaaS): A business model in which malware developers sell or lease their malware to other criminals, often through underground forums or darknet marketplaces.
Trojan: A type of malware that disguises itself as a legitimate program to trick users into installing it. Once installed, a Trojan can give malicious actors access to the infected system, steal data, install more malware, or perform other harmful actions.
Phishing: Phishing is a cyberattack method where attackers disguise themselves as trustworthy entities to trick individuals into providing sensitive information, such as passwords and credit card numbers. This often happens through deceptive emails, messages, or websites that look legitimate.
DoS (Denial of Service): A cyberattack aimed at making a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. This is often accomplished by flooding the target with excessive traffic.
Command & Control (C2): A setup used by attackers to maintain communications with compromised systems within a target network. C2 servers are used to send commands to infected machines and receive data back from them, enabling the attacker to control the malware remotely.
DNS (Domain Name System): The system that translates human-readable domain names (like www.example.com) into numerical IP addresses (like 192.0.2.1) that computers use to identify each other on the network. DNS is a fundamental component of the internet’s functionality.
Domain Generation Algorithm (DGA): An algorithm used by malware to dynamically generate a large number of domain names that can be used for C2 servers or other malicious activities. By frequently changing domains, it becomes more difficult for defenders to block or track the malware’s communication with its C2 servers.
References
