Banking Trojan Attempts To Steal Brazillion$ http://dlvr.it/Pr3jMc pic.twitter.com/NubIPgaeDg
Good read folks @SecurityBeard @r00tbsd @vanjasvajcer, I don't think DLL sideloading had been used before by BR bankers? cc @assolini
-
-
We weren’t entirely sure. The final payload is packed with Themida so we couldn’t confirm everything we wanted.
-
Hoping to take a look at some point, adding to my ever-growing to-check list :D
- Show replies
New conversation -
-
-
Hi guys, this is not the first case. Here another example using an old version of a banking plugin https://researchcenter.paloaltonetworks.com/2017/07/unit42-malspam-targeting-brazil-continues-evolve/ …
-
Yeah
@r00tbsd and I looked at this also :) we thought maybe same family but then we think it’s not related.
End of conversation
New conversation -
-
-
Only by fact of attacking Brazil. We had no Powershell in ours. Java and Delphi *shudder* packed with Themida :(
- Show replies
New conversation
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.