Researchers discovered a new banking Trojan that exploits an authentic VMware binary to deceive security tools into accepting errant activity.

According to Cisco Talos, the researchers recently observed the new malware campaign in Brazil. The operation targets the South American banking sector and attempts to pilfer the personal details of users for illegal financial profiteering.

In addition to masquerading as a legitimate process, the Trojan uses a wide range of techniques to stay hidden. IT decision-makers should stay alert to the risk posed by fast-changing malware methods and ensure that users throughout organizations follow accepted best practices.

How Is the Banking Trojan Executed?

The campaign uses spam messages written in Portuguese, since users are more likely to open an email written in their native tongue. Attackers use these emails to entice individuals to open a Boleto invoice, a popular Brazilian payment method.

This is really a malicious file with a URL that redirects users to a goo.gl URL shortener, then sends them to a RAR library that contains a JAR file. Users who double-click the JAR file trigger a Java process that initializes malicious code and installs the banking Trojan.

Java code sets up the malware and establishes a link to a remote server to download a range of supplementary files. The code then renames the previously downloaded binaries and starts a genuine binary from VMware with a digital signature. This legitimate binary, known as vm.png, fools security programs into trusting the subsequent activities of the Trojan.

Exploiting the VMware Binary

Cybercriminals often exploit the fact that some security products use a chain of trust. If an initial binary, such as vm.png, is accepted, then it is assumed that subsequent libraries will also be trustworthy. Fraudsters can use this strategy to bypass security checks.

In the case of this newly identified banking Trojan, the executed binary includes a dependency known as vmwarebase.dll. This dependency is a malicious file that allows the injection of prs.png code across explorer.exe or notepad.exe.

This process loads the Trojan’s main module, which creates an autostart registry key and the ability to inspect whether users are interacting with Brazilian financial institutions. Users are then tricked into revealing key credentials, such as their login details.

A Major Financial Risk to Users

The Cisco Talos team reported that one of the other binaries the Trojan uses is packed with the software protection tool Themida, which makes it tricky for experts to unpack the threat.

The latest threat represents a fresh attack vector. IT managers should add this risk to an ever-growing list of malware dangers and be sure to follow security best practices for protection. These practices include cautiously opening links and attachments, not downloading files from unfamiliar websites and installing antivirus software.