Securelist Brazilian Banking Malware July 2020

Javali can use large obfuscated libraries to hinder detection and analysis.

Melcoz has been packed with VMProtect and Themida.

The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.

Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.

Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

Javali can monitor processes for open browsers and custom banking applications.

Melcoz can use VBS scripts to execute malicious DLLs.

Javali has used embedded VBScript to download malicious payloads from C2.

Astaroth has used malicious VBS e-mail attachments for execution.

Grandoreiro can use VBScript to execute malicious code.

Astaroth uses JavaScript to perform its core functionalities.

Melcoz has been distributed through an AutoIt loader script.

Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.

Javali can read C2 information from Google Documents and YouTube.

Grandoreiro can obtain C2 information from Google Docs.

Astaroth uses certutil and BITSAdmin to download additional malware.

Javali can download payloads from remote C2 servers.

Melcoz has the ability to download additional files to a compromised host.

Melcoz can monitor content saved to the clipboard.

Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.

Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.

Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.

Melcoz has gained execution through victims opening malicious links.

Javali has achieved execution through victims clicking links to malicious websites.

Astaroth has used malicious files including VBS, LNK, and HTML for execution.

Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.

Melcoz can use MSI files with embedded VBScript for execution.

Grandoreiro can use MSI files to execute DLLs.

Javali has used the MSI installer to download and execute malicious payloads.

Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.

Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.

Melcoz has the ability to steal credentials from web browsers.

Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.

Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.

Astaroth has been delivered via malicious e-mail attachments.

Javali has been delivered as malicious e-mail attachments.

Javali has been delivered via malicious links embedded in e-mails.

Melcoz has been spread through malicious links embedded in e-mails.

Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.

Astaroth can launch itself via DLL Search Order Hijacking.

Melcoz can use DLL hijacking to bypass security controls.

Javali can use DLL side-loading to load malicious DLLs into legitimate executables.