New Version of the ‘Neurevt’ Trojan (aka BetaBot) Comes Bundled With Info-Stealers

guest · Aug 18, 2021

New Version of the ‘Neurevt’ Trojan Comes Bundled With Info-Stealers
August 18, 2021
https://www.technadu.com/new-version-neurevt-trojan-bundled-info-stealers/295408/

‘Neurevt’ returns in the wild through a campaign that targets Mexican bank accounts and credentials.

The trojan now comes bundled with info-stealers and backdoors, launching privilege escalation attacks.

From stealing clipboard data to monitoring keystrokes and capturing screenshots, ‘Neurevt’ can now

Click to expand...

Researchers at Cisco Talos have spotted an ongoing campaign that started in June 2021, deploying a new version of the ‘Neurevt’ trojan (aka BetaBot) and targeting mainly financial institutions in Mexico.

The main thing that is new in the recent version is that ‘Neurevt’ now comes bundled with backdoors and information stealers, so it can operate as a potent piece of malware on its own. BetaBot was first spotted all the way back in 2013, then got a big update with multi-stage packing in 2018, and from 2020 and onward, it started incorporating other malware too.
Click to expand...

Those who should be worried about the latest ‘Neurevt’ campaign are Mexicans who access their online banking accounts from their computers.

Cisco Talos found several domains that are used in the ongoing campaign as the receiving ends of the exfiltrated data, like, for example, “russk18[.]icu” and “moscow13[.]at”. While these have a clear linkage to Russia, no definitive attribution was given in the technical report.
Click to expand...

Cisco Talos: Neurevt trojan takes aim at Mexican users

This version of Neurevt exhibited multiple functionalities.
Once infected, the attacker gains access to the victim's system and modifies their system settings to conceal their existence. The trojan will access the victim's system service tokens and elevate its privilege, thereby accessing the operating system, user's account information, credentials of banking websites, capture screenshots, and connecting to the C2 servers to steal intellectual property and personal information.
Click to expand...

Log in or Sign up

New Version of the ‘Neurevt’ Trojan (aka BetaBot) Comes Bundled With Info-Stealers

guest Guest

Log in or Sign up

New Version of the ‘Neurevt’ Trojan (aka BetaBot) Comes Bundled With Info-Stealers

guest Guest

Useful Searches