October 3, 2017 By Mark Samuels 2 min read

Researchers discovered a new banking Trojan that exploits an authentic VMware binary to deceive security tools into accepting errant activity.

According to Cisco Talos, the researchers recently observed the new malware campaign in Brazil. The operation targets the South American banking sector and attempts to pilfer the personal details of users for illegal financial profiteering.

In addition to masquerading as a legitimate process, the Trojan uses a wide range of techniques to stay hidden. IT decision-makers should stay alert to the risk posed by fast-changing malware methods and ensure that users throughout organizations follow accepted best practices.

How Is the Banking Trojan Executed?

The campaign uses spam messages written in Portuguese, since users are more likely to open an email written in their native tongue. Attackers use these emails to entice individuals to open a Boleto invoice, a popular Brazilian payment method.

This is really a malicious file with a URL that redirects users to a goo.gl URL shortener, then sends them to a RAR library that contains a JAR file. Users who double-click the JAR file trigger a Java process that initializes malicious code and installs the banking Trojan.

Java code sets up the malware and establishes a link to a remote server to download a range of supplementary files. The code then renames the previously downloaded binaries and starts a genuine binary from VMware with a digital signature. This legitimate binary, known as vm.png, fools security programs into trusting the subsequent activities of the Trojan.

Exploiting the VMware Binary

Cybercriminals often exploit the fact that some security products use a chain of trust. If an initial binary, such as vm.png, is accepted, then it is assumed that subsequent libraries will also be trustworthy. Fraudsters can use this strategy to bypass security checks.

In the case of this newly identified banking Trojan, the executed binary includes a dependency known as vmwarebase.dll. This dependency is a malicious file that allows the injection of prs.png code across explorer.exe or notepad.exe.

This process loads the Trojan’s main module, which creates an autostart registry key and the ability to inspect whether users are interacting with Brazilian financial institutions. Users are then tricked into revealing key credentials, such as their login details.

A Major Financial Risk to Users

The Cisco Talos team reported that one of the other binaries the Trojan uses is packed with the software protection tool Themida, which makes it tricky for experts to unpack the threat.

The latest threat represents a fresh attack vector. IT managers should add this risk to an ever-growing list of malware dangers and be sure to follow security best practices for protection. These practices include cautiously opening links and attachments, not downloading files from unfamiliar websites and installing antivirus software.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today