October 3, 2017 By Mark Samuels 2 min read

Researchers discovered a new banking Trojan that exploits an authentic VMware binary to deceive security tools into accepting errant activity.

According to Cisco Talos, the researchers recently observed the new malware campaign in Brazil. The operation targets the South American banking sector and attempts to pilfer the personal details of users for illegal financial profiteering.

In addition to masquerading as a legitimate process, the Trojan uses a wide range of techniques to stay hidden. IT decision-makers should stay alert to the risk posed by fast-changing malware methods and ensure that users throughout organizations follow accepted best practices.

How Is the Banking Trojan Executed?

The campaign uses spam messages written in Portuguese, since users are more likely to open an email written in their native tongue. Attackers use these emails to entice individuals to open a Boleto invoice, a popular Brazilian payment method.

This is really a malicious file with a URL that redirects users to a goo.gl URL shortener, then sends them to a RAR library that contains a JAR file. Users who double-click the JAR file trigger a Java process that initializes malicious code and installs the banking Trojan.

Java code sets up the malware and establishes a link to a remote server to download a range of supplementary files. The code then renames the previously downloaded binaries and starts a genuine binary from VMware with a digital signature. This legitimate binary, known as vm.png, fools security programs into trusting the subsequent activities of the Trojan.

Exploiting the VMware Binary

Cybercriminals often exploit the fact that some security products use a chain of trust. If an initial binary, such as vm.png, is accepted, then it is assumed that subsequent libraries will also be trustworthy. Fraudsters can use this strategy to bypass security checks.

In the case of this newly identified banking Trojan, the executed binary includes a dependency known as vmwarebase.dll. This dependency is a malicious file that allows the injection of prs.png code across explorer.exe or notepad.exe.

This process loads the Trojan’s main module, which creates an autostart registry key and the ability to inspect whether users are interacting with Brazilian financial institutions. Users are then tricked into revealing key credentials, such as their login details.

A Major Financial Risk to Users

The Cisco Talos team reported that one of the other binaries the Trojan uses is packed with the software protection tool Themida, which makes it tricky for experts to unpack the threat.

The latest threat represents a fresh attack vector. IT managers should add this risk to an ever-growing list of malware dangers and be sure to follow security best practices for protection. These practices include cautiously opening links and attachments, not downloading files from unfamiliar websites and installing antivirus software.

More from

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today