Sphinx Malware Returns to Riddle U.S. Targets

guest · May 11, 2020

Sphinx Malware Returns to Riddle U.S. Targets
May 11, 2020
https://threatpost.com/sphinx-riddle-us-targets-modifications/155621/

The main upgrades in the latest version, which harvests user credentials and other personal information from online banking sessions, can be found in the process-injection and bot-configuration aspects if the malware’s operations, according to researchers.

“While Sphinx has been an on-and-off type of operation over the years, it appears it is now on-again, with version updates and new infection campaigns that are back to targeting North American banks,” Nir Shwarts and Limor Kessem at IBM X-Force Security wrote in a Monday posting.
Persistence Mechanism and Process Injection
In order to survive system reboots, Sphinx establishes persistence by adding a Run key to the Windows Registry. In its latest iteration, Sphinx establishes the Run key depending on its payload format, which can come in either executable or dynamic link library (DLL) versions.
Click to expand...

Also, Sphinx is designed with the ability to hook browser functions.
“Over the years, Sphinx has been in different hands, initially offered as a commodity in underground forums and then suspected to be operated by various closed gangs,” Shwarts and Kessem explained. “After a lengthy hiatus, this malware began stepping up attack campaigns.”
Click to expand...

IBM X-Force: Zeus Sphinx Back in Business: Some Core Modifications Arise

Log in or Sign up

Sphinx Malware Returns to Riddle U.S. Targets

guest Guest

Log in or Sign up

Sphinx Malware Returns to Riddle U.S. Targets

guest Guest

Useful Searches