CHAVECLOAK Banking Trojan Targets Brazil
CHAVECLOAK banking Trojan, a new cyber threat, is spreading its infection through SMS phishing (SMishing), phishing emails, and compromised websites.
FortiGuard Labs, a cybersecurity research team, has identified a high-severity Trojan called CHAVECLOAK that specifically targets users of Brazilian banks. This malware is designed for Windows devices and infiltrates online banking platforms, extracting banking credentials and financial data.
Although the investigation into the CHAVECLOAK infection method is ongoing, researchers suspect that potential distribution channels include phishing emails, SMS phishing, and compromised websites.
According to a blog post from the company, the campaign involves malicious emails posing as legitimate bank communications, luring users into downloading malware. It specifically targets users with Portuguese language settings, utilizing techniques such as DLL sideloading and deceptive pop-ups. The Trojan actively monitors users' interactions with financial portals.
DLL sideloading presents a significant security risk as it allows the malware to exploit legitimate processes without raising suspicion.
CHAVECLOAK Mode of Infiltration
The malware takes control of victims' devices and acquires sensitive financial information through a malicious PDF file disguised as contract documents in Portuguese. The PDF contains a malicious downloader link processed via Goo.su, leading to a ZIP file, ultimately resulting in the MSI file "NotafiscalGFGJKHKHGUURTURTF345.msi."
Upon decompression, the MSI installer reveals multiple TXT files, a legitimate execution file, and a malicious DLL named "Lightshot.dll." The installer executes the file "Lightshot.exe" using DLL sideloading techniques, enabling discreet execution of the malicious code and unauthorized activities like data theft.
Furthermore, the malware utilizes the "GetVolumeInformationW" process to gather file system and volume information, generates a log file, and executes "Lightshot.exe" upon user login. It sends HTTP requests, logs data, and monitors the foreground window using the APIs "GetForegroundWindow" and "GetWindowTextW."
The Trojan communicates with its C2 server, facilitating actions such as stealing credentials, blocking screens, logging keystrokes, and displaying deceptive pop-up windows.
Notably, the malware actively monitors access to financial portals, including Mercado Bitcoin, the largest digital currency exchange in Brazil and Latin America, which encompasses both conventional and cryptocurrency platforms and traditional banks.
Stolen information is uploaded to various paths as the malware configures account details and sends a POST request, highlighting the sophistication of contemporary banking trojans.
