Banking Malware Being Distributed By Hackers Via Password Protected Zip Files!
Cyber-cons have a new way of wreaking havoc. Hackers have found another unique way to bypass security. Reportedly the infamous BOM technique’s to blame.
The “Byte Order Mark” technique goes about altering the host’s files on the windows system.
The major superpower of the BOM is helping the threat actor group to be under the line of display or detection.
The researchers from a very widely known anti-virus firm noticed a new campaign that majorly worked on spear phishing.
The spear phishing process would help to deliver the infected files to the victim’s system.
The moment the user attempts to open the ZIP file using their default browser, it all crashes and an error sign pops up, saying.
According to the researchers, the legit ZIP files start with “PK” and are of (0x 504B). The BOM have extra three bytes (0x EFBBBF) found within UTF-8 text files.
In some systems the ZIP archive format goes undetected but in some systems it’s recognized as a UTF-8 text file and the malicious payload isn’t extracted.
The same files on the other hand could be opened via third-party functions to name a few 7-Zip & WinRAR.
Once the extraction of the file is done, the malware is executed thence beginning the infection process.
Systems using third party utilities are more susceptible to such malware attacks than the rest. The malicious executable is just a tool to help load the main payload inserted within the main source section.
The malware originates from a DDL along with a BICDAT function encrypted with the XOR based algorithm.
The library then downloads a second stage of payload, the password protected ZIP file.
The dcyber crownloaded payload material is encrypted using similar functions as the inserted payload.
After having extracted the necessary files the last and final payload is launched, which goes by the name of “Banking RAT malware.”
This RAT scours information like access card codes, dates of birth, account passwords, electronic signature, e-banking passwords and etc from the system.
Source: www.ehackingnews.com
Banking Malware Being Distributed By Hackers Via Password Protected Zip Files!
Reviewed by Anonymous
on
8:57 AM
Rating:
Reviewed by Anonymous
on
8:57 AM
Rating:
