New Banking Trojan MnuBot Discovered by IBM X-Force Research

guest · May 29, 2018

New Banking Trojan MnuBot Discovered by IBM X-Force Research
May 29, 2018
https://securityintelligence.com/new-banking-trojan-mnubot-discovered-by-ibm-x-force-research/

In contrast, the MnuBot malware uses a Microsoft SQL Server database server to communicate with the sample and send commands to be executed on the infected machine.
Committing the Fraud
Once the user has an open browsing session to his banking website account and the second stage executable of MnuBot has been download, the cybercriminal can get to work. At this point, they have an open session to the bank from the victim’s machine.
Combatting the Brazilian Financial Malware Landscape
It is most likely that MnuBot authors wanted to try to evade regular antivirus detection, which is based on the malware traffic. To do so, they decided to wrap their malicious network communication using seemingly innocent Microsoft SQL traffic.

MnuBot is an excellent example of many malware families in the Brazilian region. It holds many characteristics that are typical of other recently discovered malware strains. For example, the overlaying forms and the new desktop creation are well-known techniques that malware authors in the region use today.
Click to expand...

itman · May 29, 2018

The Trojan features two components, each in charge of a different phase of a two-stage attack flow.

During the initial stage, the malware searches for a file called Desk.txt within the %AppData%Roaming folder. This file lets MnuBot know which desktop is currently running and, if it exists, the Trojan does nothing, because it knows it runs in a new desktop.

If the file doesn’t exist, then MnuBot creates it and a new desktop, and then switches the user workspace to the new desktop, which runs alongside the legitimate user desktop.

On the newly created desktop, MnuBot constantly checks the foreground window name and, if it finds a name similar to a bank name in its configuration, the malware queries the server for the second stage executable corresponding to that bank name.

The executable, which is saved as C:\Users\Public\Neon.exe, is actually a Remote Access Trojan (RAT) that provides the attacker with full control over the target machine. It also includes functionality unique to MnuBot, IMB explains.
Click to expand...

https://www.securityweek.com/new-trojan-uses-sql-server-cc

Log in or Sign up

New Banking Trojan MnuBot Discovered by IBM X-Force Research

guest Guest

itman Registered Member

Log in or Sign up

New Banking Trojan MnuBot Discovered by IBM X-Force Research

guest Guest

itman Registered Member

Useful Searches