Source Code for CARBANAK Banking Malware Found On VirusTotal

guest · Apr 23, 2019

Source Code for CARBANAK Banking Malware Found On VirusTotal
April 23, 2019
https://thehackernews.com/2019/04/carbanak-malware-source-code.html?m=1

Security researchers have discovered the full source code of the Carbanak malware—yes, this time it's for real.
Carbanak—sometimes referred as FIN7, Anunak or Cobalt—is one of the most full-featured, dangerous malware that belongs to an APT-style cybercriminal group involved in several attacks against banks, financial institutions, hospitals, and restaurants.

Now cybersecurity researchers from FireEye revealed that they found Carbanak's source code, builders, and some previously unseen plugins in two RAR archives [1, 2] that were uploaded on the VirusTotal malware scanning engine two years ago from a Russian IP address.

"CARBANAK source code was 20MB comprising 755 files, with 39 binaries and 100,000 lines of code," researchers say. "Our goal was to find threat intelligence we missed in our previous analyses."
FireEye researchers have plans to release a 4-part series of articles detailing CARBANAK features and analysis based upon its source code and reverse engineering.
Click to expand...

FireEye: CARBANAK Week Part One: A Rare Occurrence

guest · Apr 24, 2019

CARBANAK Week Part Two: Continuing the CARBANAK Source Code Analysis
April 23, 2019
https://www.fireeye.com/blog/threat...part-two-continuing-source-code-analysis.html

In the previous installment, we wrote about how string hashing was used in CARBANAK to manage Windows API resolution throughout the entire codebase. But the authors used this same string hashing algorithm for another task as well. In this installment, we’ll pick up where we left off and write about CARBANAK’s antivirus (AV) detection, AV evasion, authorship artifacts, exploits, secrets, and network-based indicators. [...]
Conclusion
Our analysis of this source code dump confirmed it was CARBANAK and turned up a few new and interesting data points. We were able to notify vendors about disclosures that specifically targeted their security suites. The previously documented NBIs, Windows API function resolution, backdoor command hash values, usage of Windows cabinet file APIs, and other artifacts associated with CARBANAK all match, and as they say, if the shoe fits, wear it.
Click to expand...

itman · Apr 24, 2019

Now cybersecurity researchers from FireEye revealed that they found Carbanak's source code, builders, and some previously unseen plugins in two RAR archives [1, 2] that were uploaded on the VirusTotal malware scanning engine two years ago from a Russian IP address.
Click to expand...

It does make one wonder if this upload was intentional. Akin to the "mad dog chasing his tail" analogy. AV vendors patching their code to detect old and obsolete malware code and C & C infrastructure while in fact, Carbanak's authors have totally revised both code and deployment infrastructure.

guest · Apr 25, 2019

CARBANAK Week Part Three: Behind the CARBANAK Backdoor
April 24, 2019
https://www.fireeye.com/blog/threat...anak-week-part-three-behind-the-backdoor.html

In June 2017, we published a blog post sharing novel information about the CARBANAK backdoor, including technical details, intel analysis, and some interesting deductions about its operations we formed from the results of automating analysis of hundreds of CARBANAK samples.

Some of these deductions were claims about the toolset and build practices for CARBANAK. Now that we have a snapshot of the source code and toolset, we also have a unique opportunity to revisit these deductions and shine a new light on them. [...]
Conclusion
Having access to the source code and toolset for CARBANAK provided us with a unique opportunity to revisit our previous analysis. We were able to fill in some missing analysis and context, validate our deductions in some cases, and provide further evidence in other cases, strengthening our confidence in them but not completely proving them true.
Click to expand...

guest · Apr 26, 2019

CARBANAK Week Part Four: The CARBANAK Desktop Video Player
April 25, 2019
https://www.fireeye.com/blog/threat...anak-week-part-four-desktop-video-player.html

In this final blog post, we dive into one of the more interesting tools that is part of the CARBANAK toolset. The CARBANAK authors wrote their own video player and we happened to come across an interesting video capture from CARBANAK of a network operator preparing for an offensive engagement.
About the Video Player
The CARBANAK backdoor is capable of recording video of the victim’s desktop. Attackers reportedly viewed recorded desktop videos to gain an understanding of the operational workflow of employees working at targeted banks, allowing them to successfully insert fraudulent transactions that remained undetected by the banks’ verification processes.

The person being monitored via CARBANAK in this video appears to be a network operator preparing for attack. This could either be because the operator was testing CARBANAK, or because they were being monitored. The CARBANAK builder and other interfaces are never shown, and the operator is seen preparing several publicly available tools and tactics.
Click to expand...

Log in or Sign up

Source Code for CARBANAK Banking Malware Found On VirusTotal

guest Guest

guest Guest

itman Registered Member

guest Guest

guest Guest

Log in or Sign up

Source Code for CARBANAK Banking Malware Found On VirusTotal

guest Guest

guest Guest

itman Registered Member

guest Guest

guest Guest

Useful Searches