Overlay Malware Leverages Chrome Browser, Targets Banks and Heads to Spain

guest · Apr 13, 2020

Overlay Malware Leverages Chrome Browser, Targets Banks and Heads to Spain
April 13, 2020
https://threatpost.com/overlay-malw...wser-targets-banks-and-heads-to-spain/154713/

Researchers are warning of a remote overlay malware attack that leverages a fake Chrome browser plugin to target the accounts of banking customers in Spain.

Grandoreiro is a type of remote overlay banking trojan, designed to help attackers overtake devices and display a full-screen overlay image when victim accesses their online banking account. In the background, meanwhile, the attacker initiates a fraudulent money transfer from the compromised account.
The Grandoreiro malware, at the heart of this attack, is commonly known for exclusively targeting banking customers in Brazil – so this latest attack shows its operators expanding to victims in new countries.
Click to expand...

One unique technique utilized by Grandoreiro’s operators is the download of a malicious extension for the Google Chrome browser. This extension pretends to be a “Google Plugin” version 1.5.0., and is added as a visually square button to the browser window.

“We suspect that the malware uses this extension to grab the victim’s cookies and use them from another device to ride the victim’s active session,” said researchers. “With this method, the attacker won’t need to continue controlling the victim’s machine.”
Once active on the infected device, Grandoreiro waits in the background for the victim to take an action that will trigger it, such as browsing to a targeted bank’s website.

“[We] continue to see [malware spread] in the LATAM region and wherever else the language barrier can enable the same cybercriminals to operate, namely Spanish/Portuguese-speaking countries outside of LATAM,’ they said.
Click to expand...

IBM X-Force: Grandoreiro Malware Now Targeting Banks in Spain

guest · Apr 29, 2020

ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic
April 28, 2020
https://www.eset.com/us/about/newsr...a-trojan-exploiting-the-coronavirus-pandemic/

As part of an ongoing series on Latin American banking trojans, ESET researchers today published an in-depth look at Grandoreiro.
This trojan targets users especially in Brazil, Mexico, Spain and Peru. Distributed almost exclusively through email spam, it has lately started to utilize fake websites capitalizing on the global coronavirus pandemic. Grandoreiro reveals a persistent effort from its authors to evade detection.

Grandoreiro has been active since at least 2017 in Brazil and Peru, expanding to Mexico and Spain in 2019. As with other Latin American banking trojans in this series, Grandoreiro attacks its victims by displaying fake pop-up windows as a ploy to get them to divulge sensitive information.
Click to expand...

The backdoor functionality of Grandoreiro includes manipulating windows, updating itself, capturing keystrokes, simulating mouse and keyboard actions, navigating browsers to chosen URLs, signing out and restarting machines and blocking access to websites. Grandoreiro collects various information about affected machines and, in some versions, it also steals credentials stored in Google Chrome as well as data stored in Microsoft Outlook browsers.

“For a Latin American banking trojan, Grandoreiro utilizes a surprisingly large number of tricks to evade detection and emulation,” said ESET Researcher Robert Šuman.
Unlike the majority of Latin American banking trojans, Grandoreiro utilizes quite small distribution chains.
Click to expand...

ESET: Grandoreiro: How engorged can an EXE get?

Another in our occasional series demystifying Latin American banking trojans
Click to expand...

guest · Jun 24, 2020

Grandoreiro malware: what it is, how it works and how to prevent it | Malware spotlight
June 23, 2020
https://resources.infosecinstitute....orks-and-how-to-prevent-it-malware-spotlight/

There is a wide variety of remote overlay banking Trojans out there today. Despite using similar code, they differ in their respective deployment methods and infection mechanisms.

In the case of Grandoreiro, whenever a user on an infected computer visits a targeted banking website, attackers will begin making fraudulent transfers out of the account that the user signed in to. [...]
Conclusion
Grandoreiro is a remote overlay banking Trojan that has expanded its global scope of attack to include Spain. Researchers have observed the malware using references to the COVID-19 crisis in a way that plays on the interest level of the public about this sensitive topic. Make sure to keep your cyber-awareness sharp during this time of COVID-19, as more malware has been using this insidious tactic.
Click to expand...

guest · Aug 22, 2020

Grandoreiro banking trojan impersonates Spain’s tax agency
Beware the tax bogeyman – there are tax scams aplenty
August 21, 2020
https://www.welivesecurity.com/2020/08/21/grandoreiro-banking-trojan-impersonates-spain-tax-agency/

For several months, various threat actors have been attempting to impersonate governmental organizations, such as the Agencia Tributaria – the official tax agency of Spain. Here, we take a look at how the operators of Grandoreiro, an infamous Latin American banking trojan, have been using emails posing as the Agencia Tributaria in order to ensnare new victims.

The infection chain in this campaign is typical for Latin American banking trojans. First, the file to be downloaded has been placed by the malicious operators either on a compromised domain, or in a cloud storage service like Dropbox
This ZIP payload contains an MSI file and a GIF image. Homing in on the properties of the MSI file reveals that it was compiled the day before, August 10. It should also be noted that the ZIP filename has the country code “ES” at the end.

In this case, we see a new variant of the Grandoreiro banking trojan that has been particularly active in Spain in the last few weeks.
Click to expand...

Impersonating Spain’s Agencia Tributaria or other similar agencies is an old trick in the attackers’ book that has been used for a long time, especially during tax season. However, even when high season for income taxes has already concluded, this year has seen this technique being used by Latin American banking trojans and other threats specialized at stealing data.

For this reason, it is important to remain alert and to avoid clicking on a link in an email, unless you’re absolutely certain about its provenance by verifying with the sender, and to consider the possibility that an email might be attempting to pose as a governmental agency
Click to expand...

guest · Aug 19, 2022

Grandoreiro banking malware targets manufacturers in Spain, Mexico
August 19, 2022

The notorious 'Grandoreiro' banking trojan was spotted in recent attacks targeting employees of a chemicals manufacturer in Spain and workers of automotive and machinery makers in Mexico.

The malware has been active in the wild since at least 2017 and remains one of the most significant threats of its kind for Spanish-speaking users.
The recent campaign, spotted by analysts at Zscaler, started in June 2022 and is still ongoing. It involves the deployment of a Grandoreiro malware variant featuring several new features to evade detection and anti-analysis, as well as a revamped C2 system.
Click to expand...

Starts with an email
The infection chain begins with an email pretending to originate from the Attorney General's Office of Mexico City or the Spanish Public Ministry, depending on the target.

The email contains a link redirecting victims to a website that drops a ZIP archive. That file encloses the Grandoreiro loader module masqueraded as a PDF file to trick the victim into launching it.
The final payload, signed with a certificate stolen from ASUSTEK, assumes an inflated size of 400MB through the method of "binary padding" to evade sandbox analysis.
Click to expand...

Grandoreiro features
One of the new additions in the latest Grandoreiro variant sampled by Zscaler is the use of DGA (domain generation algorithm) for C2 communications, which makes mapping the malware's infrastructure and taking it down challenging.

The C2 communication pattern is now identical to that of LatentBot, using "ACTION+HELLO" beacons and ID-based cookie value responses.
Click to expand...

Outlook
The recent campaign indicates that Grandoreiro's operators are interested in conducting highly-targeted attacks instead of sending large volumes of spam emails to random recipients.
Also, the continual evolution of the malware giving it stronger anti-analysis and detection avoidance features, lays the ground for stealthier operations.

While Zscaler's report doesn't dive deep into the specific goals of the current campaign, Grandoreiro's operators have historically demonstrated financial motives, so it's assumed the case remains the same.
Click to expand...

Zscaler: Grandoreiro Banking Trojan with New TTPs Targeting Various Industry Verticals

Key Features of this Attack:

Grandoreiro targets organizations in the Spanish-speaking nations of Mexico and Spain across various industry verticals

The threat actors in this campaign impersonate Mexican Government Officials

Multiple anti-analysis techniques are used by Grandoreiro Loader along with implementation of Captcha for evading Sandboxes

The Grandoreiro Loader sends across a Check-In Request with all the required User, System and Campaign information

The Grandoreiro uses a binary padding technique to evade sandboxes, adding multiple BMP images to the resource section of the binary and inflating the size to 400+ MB

The CnC Communication pattern of 2022 Grandoreiro is now completely identical to the LatentBot with “ACTION=HELLO” beacon and ID based communication

Click to expand...

Log in or Sign up

Overlay Malware Leverages Chrome Browser, Targets Banks and Heads to Spain

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Overlay Malware Leverages Chrome Browser, Targets Banks and Heads to Spain

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches