Tedrade banking malware families target users worldwide

Cybersecurity researchers from Kaspersky Lab have detailed four different families of Brazilian banking trojans avg internet security, tracked as Tetrade, that have targeted financial institutions in Brazil, Latin America, and Europe.The four malware families are named Guildma, Javali, Melcoz, and Grandoreiro, experts believe are the result of a Brazilian banking group/operation that avg.com/retail    is evolving its capabilities www.avg.com/activate targeting banking avg antivirus free users abroad.The Brazilian cyber crime  is recognized as the Install Avg With License Number activation most focuses on the development and commercialization of banking trojans.

The Guildma malware has been active since at least 2015, it was initially observed in attacks exclusively aimed at Brazilian banking users. The malicious code has been constantly updated, the authors implemented new features and extended the list of the targets over the time.

The malware operators have shown a good knowledge of legitimate tools and used them to prevent the threat from being www.avg.com/activate detected from security avg antivirus free solutions.

Guildma spreads rely heavily on email shots containing a malicious file in compressed format, attached to avg internet security the email body. File types vary from Visual Basic Script to LNK.”reads the analysis published by Kaspersky. “Most of the phishing messages emulate business requests, packages sent avg.com/retail    over courier services avg antivirus free or any other regular corporate subjects Install Avg With License Number activation, including the COVID-19 pandemic, but always with a corporate appearance.

Javali has been active since November , it was primarily focusing on the customers of financial institutions located in Brazil and Mexico. 

Both Guildma and Javali employ a multi-stage attack chain and were distributed using phishing messages using compressed www.avg.com/activate email attachments (e.g., .VBS, .LNK) or an HTML file which executes Javascript for downloading a malicious file.

Experts noticed that the malware uses the BITSAdmin tool to download the additional modules. Attackers used the tool to avoid detection since avg antivirus free it is whitelistedfrom the Windows operating avg internet security system.

The malware also leverages alternate avg.com/retail    data stream to hide the presence of the downloaded payloads, and employes DLL search order hyjacking to launch the malware binaries.

“In order to execute the additional modules, the malware uses the process hollowing technique for hiding the malicious www.avg.com/activate payload inside a whitelisted process, such as svchost.exe. The payloads are stored encrypted in the filesystem and decrypted in the memory as they are executed.” continues Kaspersky. “The final payload installed in the system will monitor user activities Install Avg With License Number activation, such as opened websites and run applications and check if they are on the target list. When a target is detected, the module is executed, giving the criminals control over banking transactions.”

Once the final payload is installed on the target system, it monitors for specific bank websites. When the victim will open these sites avg.com/retail   , the attackers will gain control over any financial transaction performed by the users.

Melcoz is an open-source RAT developed by a group that has been active in Brazil at least since 2018, then it has expanded operations avg internet security overseas, including Chile and Mexico.Melcoz is able Install Avg With License Number activation to steal passwords from browsers, and avg antivirus free information from clipboard and www.avg.com/activate Bitcoin wallets by replacing the original wallet details with the one under the control of the attacker. avg.com/retail   The attack chain begins with phishing messages containing a link to a downloadable MSI installer.

The VBS scripts in installer package files (.MSI) download the malware on the system and then abuses AutoIt interpreter avg internet security and VMware NAT service to load the malicious DLL on the target system.