Casbaneiro Banking Malware Goes Under the Radar with UAC Bypass Technique

The financially enthusiastic risk actors powering the Casbaneiro banking malware family members have been noticed producing use of a Consumer Account Manage (UAC) bypass technique to get complete administrative privileges on a machine, a signal that the menace actor is evolving their tactics to avoid detection and execute malicious code on compromised belongings.

“They are however intensely targeted on Latin American financial institutions, but the changes in their approaches symbolize a major risk to multi-regional fiscal companies as very well,” Sygnia mentioned in a assertion shared with The Hacker News.

Casbaneiro, also acknowledged as Metamorfo and Ponteiro, is finest acknowledged for its banking trojan, which very first emerged in mass email spam campaigns targeting the Latin American financial sector in 2018.

An infection chains normally begin with a phishing email pointing to a booby-trapped attachment that, when released, activates a series of actions that culminate in the deployment of the banking malware, alongside scripts that leverage dwelling-off-the-land (LotL) approaches to fingerprint the host and assemble program metadata.

Also downloaded at this phase is a binary referred to as Horabot that’s intended to propagate the infection internally to other unsuspecting workers of the breached group.

“This adds trustworthiness to the email sent, as there are no clear anomalies in the email headers (suspicious external domains), which would normally induce email security solutions to act and mitigate,” the cybersecurity corporation mentioned in a previous report printed in April 2022. “The email messages incorporate the exact same PDF attachment employed to compromise the past sufferer hosts, and so the chain is executed at the time more.”

What’s adjusted in current attack waves is that the attack is kick-begun by spear-phishing email embedded with a backlink to an HTML file that redirects the focus on to obtain a RAR file, a deviation from the use of destructive PDF attachments with a obtain backlink to a ZIP file.

Approaching WEBINARShield Versus Insider Threats: Master SaaS Security Posture Administration

Nervous about insider threats? We have acquired you covered! Be a part of this webinar to investigate sensible approaches and the tricks of proactive security with SaaS Security Posture Administration.

Join Nowadays

A 2nd major change to the modus operandi fears the use of fodhelper.exe to accomplish a UAC bypass and achieve higher integrity degree execution.

Sygnia mentioned it also observed Casbaneiro attackers creating a mock folder on C:Windows[space]method32 to duplicate the fodhelper.exe executable, even though the specially crafted path is said to have never ever been used in the intrusion.

“It is probable that the attacker deployed the mock folder to bypass AV detections or to leverage that folder for side-load DLLs with Microsoft-signed binaries for UAC bypass,” the company reported.

The improvement marks the 3rd time the mock trusted folder method has been detected in the wild in modern months, with the system made use of in campaigns delivering a malware loader called DBatLoader as properly as distant accessibility trojans like Warzone RAT (aka Ave Maria).

Observed this article attention-grabbing? Adhere to us on Twitter  and LinkedIn to study additional exceptional content we article.

Some parts of this article are sourced from:
thehackernews.com