Redaman Spams Russian Banking Customers with Rotating Tactics

guest · Jan 23, 2019

Redaman Spams Russian Banking Customers with Rotating Tactics
January 23, 2019
https://threatpost.com/redaman-spams-russian-banking-customers-with-rotating-tactics/141129/

Redaman as a malware first came on the scene in 2015, and since then has consistently targeted victims that use Russian financial institutions. But from September through December 2018, researchers at Palo Alto Networks’ Unit 42 division saw increasing numbers of mass spam messages delivering the trojan.

The emails targeted Russian email recipients, often with email addresses ending in .ru, and delivered their payloads via a rotating assortment of archived Windows executable files disguised as PDF documents, according to the firm’s analysis.

Redaman in most other aspects is a typical banking trojan [...] also has a full cadre of misdeeds at its disposal, including downloading additional files (including a variant of the Pony info-stealer), keylogging activity, taking screen shots [...]
Olson told Threatpost that Redaman stands out because of its rapidly evolving tactics as well as the fact that it “appears to be used primarily to target Russians, which is somewhat out of the ordinary.”
Click to expand...

guest · Oct 19, 2019

This Malware is Hiding C&C Server IPs in the Blockchain
Latest malware to hide C&C in Blockchain wallets
October 18, 2019
https://www.cbronline.com/news/redaman-blockchain

A new strain of the banking malware Redaman is hiding dynamic command and control (C&C) server IP addresses inside the Bitcoin blockchain, researchers at Checkpoint say.
Redaman is banking malware that mostly targets Russian speakers. It was first seen in 2015. Its creators have a track record of using innovative techniques to avoid detection.
Redaman Malware Using Blockchain
Interestingly, and in what appears to be a growing trend, the latest Redman version hides the dynamic IP address of its C&C server by converting each octet of the IP address from decimal to hexadecimal:, e.g. 185.203.116.47 => B9.CB.74.2F, scrambling the latter, then hiding it in the form of a small payment to their own Bitcoin wallet.

To reveal the C&C address, Redaman send a GET request to get the last ten transactions on the hard coded Bitcoin wallet; it takes the values of the last two payment transactions to Bitcoin wallets, converts the Decimal values from the transactions to Hexadecimal; splits the Hexadecimal value to low and high bytes, changes the order and converts them back to decimal; these values together combine the IP address of the hidden C&C server.
Click to expand...

Check Point: Pony’s C&C servers hidden inside the Bitcoin blockchain

The malware connects to Bitcoin blockchain and chaining transactions in order to find the hidden C&C server, we called this new technique Chaining.
Click to expand...

Log in or Sign up

Redaman Spams Russian Banking Customers with Rotating Tactics

guest Guest

guest Guest

Log in or Sign up

Redaman Spams Russian Banking Customers with Rotating Tactics

guest Guest

guest Guest

Useful Searches