Malspam Targeting Brazil Continues to Evolve
Brazilian malspam campaigns continue evolving, abusing Google URL shortener and Dropbox and using Squiblydoo plus DLL side-loading to deploy likely infostealing botnet malware.
A June 2017 Brazilian malspam campaign spoofed IPTU tax notification emails, using the recipient's address as the sender, and abused Google's URL shortener and Dropbox to deliver a zip containing a malicious Windows shortcut (.lnk) file. The LNK used the Squiblydoo technique (regsvr32.exe) to download and execute a scriptlet with elevated privileges, retrieving a signed G-Buster Browser Defense executable alongside a malicious fltLib.dll loaded via side-loading, likely an information-stealing botnet. Post-infection HTTP traffic exposed over 400 infected Windows hosts, mostly in Brazil, with 2,132 Banload-tagged samples observed in the first half of 2017.
- Spoofed IPTU tax emails used the recipient's address as sender, sent from an Italian IP
- Google URL shortener and Dropbox abuse deliver a malicious LNK file inside a zip archive
- Squiblydoo regsvr32 technique executes scriptlets with elevated privileges to bypass application allowlisting
- Signed G-Buster (GbpSv.exe) side-loads malicious fltLib.dll, hiding it from antivirus
- Post-infection traffic revealed more than 400 infected hosts, mostly in Brazil
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1218.010 Regsvr32T1574.002 DLL Side-Loading
- Products
- G-Buster Browser Defense
- Malware
- BanloadfltLib.dll
- Countries
- BrazilArgentinaCzech RepublicRussia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | impostocontribuinte.com | leapis[.]com - GET /pid/2via.html HTTP via port 80 - gov.br.impostocontribuinte[.]com - GET /Contribuinte/Iptu/ HTTPS via port 443 - dropbox[.] |
| ipv4 | 212.237.35.135 | headers show the message came from an Italian IP address at 212.237.35.135. The attackers used a spoofed sender address: specifically, |
| sha256 | 71eb0797db8de8ff5a9fe84b5568cd728b4b089537e4e1b5fd55b42de8b3fa07 | ow-up malware downloaded by the above SCT file SHA256 hash: 71eb0797db8de8ff5a9fe84b5568cd728b4b089537e4e1b5fd55b42de8b3fa07 File name: bxmmyDLr.exe File description: G-Buster executab |
| sha256 | 94cf47c57413753ecc8c648384b475e96f13f8caca648b9240486340e1d91aa0 | other SCT file called from the first scriptlet SHA256 hash: 94cf47c57413753ecc8c648384b475e96f13f8caca648b9240486340e1d91aa0 File name: ipv3.zip File description: Follow-up malware dow |
| sha256 | a4cf9811c55d0e4f2f8c783d1458ab3a5d69244287030a0a8154e89ed6ae02b0 | p archive after clicking link from the malspam SHA256 hash: a4cf9811c55d0e4f2f8c783d1458ab3a5d69244287030a0a8154e89ed6ae02b0 File name: Notificacao(Iptu-.-2017).lnk File description: E |
| sha256 | b42994352613e6bf63599dac0e2d4ddaf2b868842d5f04749f437f8335a63309 | - POST /ipv3/index.php Associated file hashes: SHA256 hash: b42994352613e6bf63599dac0e2d4ddaf2b868842d5f04749f437f8335a63309 File name: Notificacao(Iptu-.-2017).zip File description: D |
| sha256 | e7374e5ec576d95155c3b35d799656aba33315edbc9cdc7f0a04ed201135843a | ndows shortcut (LNK) file from the zip archive SHA256 hash: e7374e5ec576d95155c3b35d799656aba33315edbc9cdc7f0a04ed201135843a File name: sdar7hsy_2_.sct File description: Scriptlet (SCT |
| sha256 | ed491c8d0b4ea30a3a4d78c2ee713d72b7ff4b1f90e04a86a775852953ade892 | le returned after double-clicking the LNK file SHA256 hash: ed491c8d0b4ea30a3a4d78c2ee713d72b7ff4b1f90e04a86a775852953ade892 File name: gw4c9sql_1_.sct File description: Another SCT fi |
| sha256 | faf0892be515437f9dfc86040e130533722b6149d65000969ebb334253cf4b89 | bpSv.exe) made persistent on the infected host SHA256 hash: faf0892be515437f9dfc86040e130533722b6149d65000969ebb334253cf4b89 File name: fltLib.dll File description: Malicious DLL loade |
From the original article
5 min read at unit42.paloaltonetworks.com
For years now, criminals behind banking Trojans, remote access tools (RATs) and other types of malware have targeted Microsoft Windows hosts in Brazil through malicious spam (malspam). Antivirus often detects the associated malware as "Banload," a family of Trojans that downloads other malware. We've identified 9,215 samples tagged "Banload" in AutoFocus since December 2013.
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.