October 3, 2017 By Mark Samuels 2 min read

Researchers discovered a new banking Trojan that exploits an authentic VMware binary to deceive security tools into accepting errant activity.

According to Cisco Talos, the researchers recently observed the new malware campaign in Brazil. The operation targets the South American banking sector and attempts to pilfer the personal details of users for illegal financial profiteering.

In addition to masquerading as a legitimate process, the Trojan uses a wide range of techniques to stay hidden. IT decision-makers should stay alert to the risk posed by fast-changing malware methods and ensure that users throughout organizations follow accepted best practices.

How Is the Banking Trojan Executed?

The campaign uses spam messages written in Portuguese, since users are more likely to open an email written in their native tongue. Attackers use these emails to entice individuals to open a Boleto invoice, a popular Brazilian payment method.

This is really a malicious file with a URL that redirects users to a goo.gl URL shortener, then sends them to a RAR library that contains a JAR file. Users who double-click the JAR file trigger a Java process that initializes malicious code and installs the banking Trojan.

Java code sets up the malware and establishes a link to a remote server to download a range of supplementary files. The code then renames the previously downloaded binaries and starts a genuine binary from VMware with a digital signature. This legitimate binary, known as vm.png, fools security programs into trusting the subsequent activities of the Trojan.

Exploiting the VMware Binary

Cybercriminals often exploit the fact that some security products use a chain of trust. If an initial binary, such as vm.png, is accepted, then it is assumed that subsequent libraries will also be trustworthy. Fraudsters can use this strategy to bypass security checks.

In the case of this newly identified banking Trojan, the executed binary includes a dependency known as vmwarebase.dll. This dependency is a malicious file that allows the injection of prs.png code across explorer.exe or notepad.exe.

This process loads the Trojan’s main module, which creates an autostart registry key and the ability to inspect whether users are interacting with Brazilian financial institutions. Users are then tricked into revealing key credentials, such as their login details.

A Major Financial Risk to Users

The Cisco Talos team reported that one of the other binaries the Trojan uses is packed with the software protection tool Themida, which makes it tricky for experts to unpack the threat.

The latest threat represents a fresh attack vector. IT managers should add this risk to an ever-growing list of malware dangers and be sure to follow security best practices for protection. These practices include cautiously opening links and attachments, not downloading files from unfamiliar websites and installing antivirus software.

More from

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today