Dridex Banking Trojan, RMS RAT Dropped via Fake eFax Messages

guest · Jul 8, 2019

Dridex Banking Trojan, RMS RAT Dropped via Fake eFax Messages
July 8, 2019
https://www.bleepingcomputer.com/ne...rojan-rms-rat-dropped-via-fake-efax-messages/

Researchers from Cofense have discovered a new malspam campaign that delivers fake eFax messages designed to drop a banking Trojan and RAT cocktail via malicious Microsoft Word document attachments.

The attackers use the two payloads to perform different tasks: the Dridex banking Trojan to collect credentials from web browsers and to exfiltrate them to their own servers, and the RMS RAT for managing the infected computers.
Cofense's research team also added that "And having both available provides a backup communication channel in case one of the malware families is detected and removed."
Web injects used to abuse victims' web browsers
Just as in the case of other banking Trojans, the Dridex strain disseminated via this malspam campaign also uses web injects in the form of scripts loaded by the infected machine when visiting a targeted website.

The attackers use Dridex to target several types of sites, from cryptocurrency and banking websites to e-commerce websites, with web injects deployed from different command-and-control (C2) servers. Notably, some of the scripts used for the same websites are tagged as 'Zeus' injects, another banking Trojan used for information stealing.
Click to expand...

Cofense: Double Duty: Dridex Banking Malware Delivered with RMS RAT

Log in or Sign up

Dridex Banking Trojan, RMS RAT Dropped via Fake eFax Messages

guest Guest

Log in or Sign up

Dridex Banking Trojan, RMS RAT Dropped via Fake eFax Messages

guest Guest

Useful Searches