So, in past days Brazilian people got this in email. Of course, the link not points to a file on gov website, but to a file on FB's CDN...pic.twitter.com/q0BfMphVOl
Show this thread
Just noticed some big campaigns using @facebook's CDN...
Smart from actors, as AV companies won't block their CDN.
cc @GossiTheDog @x0rz
-
-
-
Here is the link: https://www.virustotal.com/en/url/85110e62c8b4ac79cd830aa59da0b26f649b85e7156fd6938bb25415e3f54441/analysis/1504334444/ … Not only it comes from FB's CDN, but comes over HTTPS. You can see, after 30 hours, still FUD...
Show this thread -
Right now, the file is still available on the CDN. If it would taken down eventually, here is the file: https://www.virustotal.com/en/file/1faa46ba708e3405e7053cde872c65cc7a7d7fbf6411374eb6e977f20c160e16/analysis/1504334448/ … Detections:pic.twitter.com/RUIDW2VYT1
Show this thread -
In less than 24h, more than 200.000 people opened the emails from Brazil. And that number is the very least, likely lots more... cc
@certbrpic.twitter.com/IfogZLMDzh
Show this thread -
The sample is a link file which runs PowerShell, to download a PowerShell script (also over HTTPS) and invokes it...pic.twitter.com/zCJzpz6wxf
Show this thread -
They are serious actors for sure. APT? If you are not from Brazil, all you get is an empty dll: https://www.virustotal.com/en/file/8ff95bae4b9939943abd64c933d90913f4113834c564305eb826f732d663f36a/analysis/1504343406/ … cc
@JAMESWT_MHTpic.twitter.com/5gamNdQZHR
Show this thread -
If you are from Brazil, the response is this PowerShell script (on screenshot). The loader dll has only 1 detection: https://www.virustotal.com/en/file/41e463cd5d4cf20d02bb7cd23b70465480d1cd5cd3c9f8653e9f93b3a85124d8/analysis/1504346407/ …pic.twitter.com/Upb1VkZXA6
Show this thread -
Loader will dl some files (obviously). Also has checks like specific things are installed or not, checks (IP) if running in BR or not, etc.
Show this thread -
I will continue working on this later, I have something other to do in next hours...
Show this thread -
So, got some more of the files, etc... But some things are missing, so can't continue. Probably as campaign is over, they changed something.
Show this thread -
But based on
@ESET_Brasil's article (https://twitter.com/cpuodzius/status/904019075235491841 …), final payload would be (or include) a banker. But ofc, can't tell for sure.Show this thread
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.