Blackmoon Banking Trojan Continues to Target South Korea

 

Cybercriminals have persisted to use the Blackmoon banking Trojan to focus on folks in South Korea, and the malware is now being delivered via a brand new framework that helps sidestep detection.

Blackmoon, also known as KRBanker and Banbra, has been around considering that as a minimum 2014 and its main intention is to steal on-line banking credentials from users in South Korea. just over 365 days in the past, Fortinet researchers said that the malware had contaminated the methods of greater than 100,000 of the united states’s customers.

Fidelis Cybersecurity suggested on Thursday that it had noticed two separate Blackmoon campaigns because late 2016, and they relied on a new framework that researchers have named the Blackmoon Downloader Framework.

The framework is designed to obtain a few elements over three stages, and it ensures that the malware is most effective dropped at customers in South Korea.

in line with experts, the assault starts with an initial downloader that is below 10 Kb in size. This downloader can execute any code on the infected laptop, essentially creating a backdoor, however it serves a easy objective – downloading and executing a bytecode downloader.

within the 2d stage, the bytecode downloader fetches a PE file disguised as a harmless JPG picture. This pretend image file, dubbed by using Fidelis “KRDownloader,” is liable for downloading the actual Blackmoon payload. The KRDownloader element can also be designed to be sure that the infected gadget’s language is set to Korean. If the language will not be Korean, the bot terminates.

“The framework is tightly coupled and designed to function in sequence to facilitate more than one targets, together with evasion in addition to geolocation concentrated on,” Fidelis mentioned in a weblog put up. “The multistage downloader serves a realistic purpose: it’s another tactic used most likely to steer clear of detection, as functionality is distributed between these separate (but related) elements.”

Blackmoon is designed to focus on a long record of websites, together with ones belonging to top monetary firms in South Korea, reminiscent of Citibank Korea, Hana financial institution, KB, Shinhan financial institution, Woori financial institution, usual Chartered and Samsung Card.

The malware makes use of a way known as “pharming” to assemble valuable knowledge. When victims get right of entry to one of the targeted sites from an contaminated desktop, they are redirected to a faux web page the place they are instructed to supply their credentials and other knowledge.

security corporations in the past suggested that cybercriminals had used quite a lot of the way to ship the Blackmoon Trojan, including spyware and adware and exploit kits.

associated: targeted Malware campaign makes use of HWP paperwork

related: “Duuzer” Trojan Used to target South Korean companies

associated: Cyber Gang Steals thousands and thousands From mobile Banking shoppers in South Korea

SecurityWeek RSS Feed