Astaroth Trojan – Facebook, YouTube insider threats used in Brazilian phishing scheme

mood · Sep 12, 2019

Facebook, YouTube insider threats used in Brazilian phishing scheme
September 12, 2019
https://www.scmagazine.com/home/ema...er-threats-used-in-brazilian-phishing-scheme/

A cybercriminal gang has put together a phishing campaign that utilizes several trusted sources, along with insider help from a top tier security company to convince its victims to open and download a malicious attachment.

Cofense Intelligence found the malicious actors, who are only targeting Brazilians, are extensively using trusted names, legitimate Windows services and Cloudflare workers to inject the Astaroth trojan with the aim of stealing banking credentials. However, despite the effort put forth by the gang Cofense researchers said the attacks can be stopped if the proper precautions, both human and technical, are in place.

[...] downloads multiple files that help obfuscate and execute the Astaroth information stealer, including two .DLL files that are joined together and side-loaded into a legitimate program named ‘C:\Program Files\Internet Explorer\ExtExport.exe’, Cofense wrote.
The latter downloads help with avoiding AV, white listing and URL filtering security functions.
Click to expand...

The malware then uses a technique called process hollowing where it takes previously downloaded code and injects it into several legitimate programs, the most important of which is unins000.exe that is associated with the Brazilian banking system.
Astaroth then uses the normally trustworthy sites Youtube and Facebook profiles to host and maintain the C2 configuration data.

“ The data is within posts on Facebook or within the profile information of user accounts on YouTube. By hosting the C2 data within these trusted sources, the threat actors can bypass network security measures like content filtering. [...]"
Click to expand...

Cofense: Astaroth Uses Facebook and YouTube within Infection Chain

Log in or Sign up

Astaroth Trojan – Facebook, YouTube insider threats used in Brazilian phishing scheme

mood Updates Team