In April, security researchers at Zscaler came across malware that targets a specific bank and steals user credentials. This infostealer Trojan seems to be Spanish in origin, and so far has targeted users in the U.S. and Mexico.

Mexico’s second-largest bank, Banamex, is its current target. However, the Trojan could be configured to attack other financial institutions.

About the Infostealer Trojan Operation

The installer that is the Trojan payload’s limousine has two extensions in its file name. This seems to be a way to try to impersonate a PDF file, but it appears on the desktop as a generic .exe file, not a PDF, so the camouflage fails.

The installer will attempt to download three files: the actual infostealer, a Fiddler proxy engine for .net applications and open-source JSON framework for .net applications. Interestingly, the last two files are legitimate: Though they are being used by the malware authors for malicious purposes, the code seems to be unaltered from its original state.

All three of the files are downloaded to the Windows system directory. The infostealer checks for the Fiddler and JSON files upon starting. If they’re not present, it will attempt to download them from a hard-coded location.

For Windows XP and Windows Server 2003, the malware creates an autostart registry key entry ensuring the persistence of the malware if the system is rebooted. It behaves differently on other Windows versions, installing root certificates early in the process.

The malware then collects information from the victim’s system, after which it is sent to a remote C&C server in an encoded format, according to Zscaler. The banking Trojan uses the Fiddler proxy engine to intercept Web connections and redirect the users to the attacker-controlled server, which hosts the impostor banking website.

The Fiddler proxy engine comes in handy here; it sends the victim to the fake website but resolves the domain to the IP address so the fraudulent page appears legitimate. There, the user’s banking credentials can be intercepted.

Warnings for the Future

Attackers can modify this Trojan rather simply. There is a 10-minute loop in the code that downloads a configuration file, so any changes to that file will quickly propagate.

Thinking this is a limited attack on one Mexican bank is shortsighted. The framework can be easily changed and expanded to threaten more people in the near future.