Exploring the Latest Mispadu Stealer Variant
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.
Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.
Key facts
- New Mispadu variant written in Delphi; analyzed loader is ~4 KB, compiled 2023-11-12.
- Crafted .url files referencing UNC network-share paths bypass SmartScreen warnings.
- Specifying HTTP port @80 in the UNC path forces WebDAV retrieval via rundll32.exe.
- Victims predominantly in Mexico; ZIP payloads likely distributed as email attachments.
- CVEs
- CVE-2023-36025
- Vendors
- Microsoft
- Products
- SmartScreenMispadu Stealer
- Threat actors
- Mispadu
- Malware
- Mispadu
- Organizations
- Palo Alto NetworksESETUnit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-36025 | Windows SmartScreen Bypass (CVE-2023-36025) Exploited via Crafted Shortcut Files | 8.8 | 88% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bbvanet.com.mx | bancadigital.monex[.]com[.]mx nixe.ixe[.]com[.]mx empresas.bbvanet[.]com[.]mx These hosts align toward financial institutions, financ |
| domain | hsbc.com.mx | s where ?? represents unidentified SHA256 hashes: www.??.??.hsbc[.]com[.]mx www1.secure.hsbcnet[.]com bancadigital.monex[.]com[.]mx |
| domain | hsbcnet.com | tified SHA256 hashes: www.??.??.hsbc[.]com[.]mx www1.secure.hsbcnet[.]com bancadigital.monex[.]com[.]mx nixe.ixe[.]com[.]mx empresa |
| domain | ixe.com.mx | ww1.secure.hsbcnet[.]com bancadigital.monex[.]com[.]mx nixe.ixe[.]com[.]mx empresas.bbvanet[.]com[.]mx These hosts align toward fi |
| domain | monex.com.mx | ?.??.hsbc[.]com[.]mx www1.secure.hsbcnet[.]com bancadigital.monex[.]com[.]mx nixe.ixe[.]com[.]mx empresas.bbvanet[.]com[.]mx These h |
| domain | trilivok.com | 6 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 hxxps : //trilivok[.]com/4g3031ar0/cb6y1dh/it.php hxxp : //trilivok[.]com/4g3031ar |
| ipv4 | 24.199.98.128 | execute a malicious binary named 2456719228.exe : file[:]\\24.199.98[.]128@80\expediente38\1477606991\2456719228.exe The malicious . |
| md5 | 723df0296951abd2aeed01361cec6b0d | 5a46ad4ea SHA1 ba6d10e36f41c4ebc85f6beb95afd2b7c92406ad MD5 723df0296951abd2aeed01361cec6b0d Size 4,298,240 bytes File Type PE32+ executable (GUI) x86-6 |
| sha1 | ba6d10e36f41c4ebc85f6beb95afd2b7c92406ad | c3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea SHA1 ba6d10e36f41c4ebc85f6beb95afd2b7c92406ad MD5 723df0296951abd2aeed01361cec6b0d Size 4,298,240 bytes F |
| sha256 | 018beb515d323dee4f04ad9663863324859f4eb896576dbef1df950568084030 | c4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 com 018beb515d323dee4f04ad9663863324859f4eb896576dbef1df950568084030 enlace bbaba0482f486b0d7b7738af8bc4731dbb80faef7f8b3888d985 |
| sha256 | 0332d65ee6d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa10317445a9 | 498d802ce7f47739ae9d93236f83811335da55aef1dc1c17694f53 nbem 0332d65ee6d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa10317445a9 nixe 974fe99972905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b |
| sha256 | 03bdae4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46ba15f | fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52 03bdae4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46ba15f 1b7dc569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0 |
| sha256 | 135c9ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d382b81f | 8e2cff36fc896497d4539397e8334aa9a5910e73b45bde4f7206aa5ebe3 135c9ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d382b81f 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7a |
| sha256 | 1b7dc569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0486a0 | e4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46ba15f 1b7dc569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0486a0 e136717630164116c2b68de31a439231dc468ddcbee9f74cca511df1036 |
| sha256 | 3e165f375f498d802ce7f47739ae9d93236f83811335da55aef1dc1c17694f53 | d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf617a92045085 mx 3e165f375f498d802ce7f47739ae9d93236f83811335da55aef1dc1c17694f53 nbem 0332d65ee6d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa |
| sha256 | 44c505974154050ec0c671eb2f1d27f72886243bfafff8c3523b0ce1d64f944a | 733a4eb2ebc615fbfdbc9b278aaa15ad23d661696ae54eb186a5a4 www1 44c505974154050ec0c671eb2f1d27f72886243bfafff8c3523b0ce1d64f944a www2 Table 2. Brute-forced strings used to target specific |
| sha256 | 46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52 | 5289bac897e881141e281c18c606a772a53356cc81caf38e5c6296641d4 46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52 03bdae4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46 |
| sha256 | 4a774438d15381d9ab308dd73c2917aee83897d654c39db24f4dd6f173564914 | dad213707537bdc0172509b9135115337c5744816b079390d5a3e82 www 4a774438d15381d9ab308dd73c2917aee83897d654c39db24f4dd6f173564914 ixe 4b276d43308450619fec6befdf92c5171298e3651ed6f06a5a637f8 |
| sha256 | 4b276d43308450619fec6befdf92c5171298e3651ed6f06a5a637f8a5afc407f | 15381d9ab308dd73c2917aee83897d654c39db24f4dd6f173564914 ixe 4b276d43308450619fec6befdf92c5171298e3651ed6f06a5a637f8a5afc407f monex e8deebe849f80654b53b73d41a379919a86c4c356715d34729335 |
| sha256 | 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 | ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d382b81f 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 We observed a total of 15 groupings of hashes for this malw |
| sha256 | 4e209b1dd2d4eaa3b041dddbe7f1bd0c6b07145c0102999060d7ceeb64978e90 | bf7f4513b64658c751148304f287b13df26890642d64b75c264 bbvanet 4e209b1dd2d4eaa3b041dddbe7f1bd0c6b07145c0102999060d7ceeb64978e90 hsbcnet b70ad99286733a4eb2ebc615fbfdbc9b278aaa15ad23d661696 |
| sha256 | 748a57a4d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf617a92045085 | 486b0d7b7738af8bc4731dbb80faef7f8b3888d9859726dbd53957 hsbc 748a57a4d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf617a92045085 mx 3e165f375f498d802ce7f47739ae9d93236f83811335da55aef1dc1c |
| sha256 | 8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea | wn in Table 1 for our analysis: Characteristic Value SHA256 8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea SHA1 ba6d10e36f41c4ebc85f6beb95afd2b7c92406ad MD5 723df0296 |
| sha256 | 974fe99972905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b3b70af2b10 | d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa10317445a9 nixe 974fe99972905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b3b70af2b10 see ac027e988dad213707537bdc0172509b9135115337c5744816b0793 |
| sha256 | ac027e988dad213707537bdc0172509b9135115337c5744816b079390d5a3e82 | 2905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b3b70af2b10 see ac027e988dad213707537bdc0172509b9135115337c5744816b079390d5a3e82 www 4a774438d15381d9ab308dd73c2917aee83897d654c39db24f4dd6f |
| sha256 | b70ad99286733a4eb2ebc615fbfdbc9b278aaa15ad23d661696ae54eb186a5a4 | aa3b041dddbe7f1bd0c6b07145c0102999060d7ceeb64978e90 hsbcnet b70ad99286733a4eb2ebc615fbfdbc9b278aaa15ad23d661696ae54eb186a5a4 www1 44c505974154050ec0c671eb2f1d27f72886243bfafff8c3523b0c |
| sha256 | bbaba0482f486b0d7b7738af8bc4731dbb80faef7f8b3888d9859726dbd53957 | 3dee4f04ad9663863324859f4eb896576dbef1df950568084030 enlace bbaba0482f486b0d7b7738af8bc4731dbb80faef7f8b3888d9859726dbd53957 hsbc 748a57a4d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf61 |
| sha256 | bc25f7836c273763827e1680856ec6d53bd73bbc4a03e9f743eddfc53cf68789 | 54dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea bc25f7836c273763827e1680856ec6d53bd73bbc4a03e9f743eddfc53cf68789 fb3995289bac897e881141e281c18c606a772a53356cc81caf38e5c6296 |
| sha256 | cf546a4c5c7fdd3935ed7d93f5482057e3c8ff8723c3a73caba1fc5e3a5c96b4 | ying strings, as noted below in Table 2. SHA256 Hash String cf546a4c5c7fdd3935ed7d93f5482057e3c8ff8723c3a73caba1fc5e3a5c96b4 bitso 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff9 |
| sha256 | d4fed9ca90249707099926e336c0ec5abc0be8fbeb0e1889f7259e0e7312b9a0 | 0654b53b73d41a379919a86c4c356715d34729335e79089127c7 secure d4fed9ca90249707099926e336c0ec5abc0be8fbeb0e1889f7259e0e7312b9a0 wallet d752b7472110cbf7f4513b64658c751148304f287b13df268906 |
| sha256 | d752b7472110cbf7f4513b64658c751148304f287b13df26890642d64b75c264 | 9707099926e336c0ec5abc0be8fbeb0e1889f7259e0e7312b9a0 wallet d752b7472110cbf7f4513b64658c751148304f287b13df26890642d64b75c264 bbvanet 4e209b1dd2d4eaa3b041dddbe7f1bd0c6b07145c0102999060d |
| sha256 | dd4018e2cff36fc896497d4539397e8334aa9a5910e73b45bde4f7206aa5ebe3 | he prepended hash, resulting in the following three hashes: dd4018e2cff36fc896497d4539397e8334aa9a5910e73b45bde4f7206aa5ebe3 135c9ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d38 |
| sha256 | e136717630164116c2b68de31a439231dc468ddcbee9f74cca511df1036a22ea | 569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0486a0 e136717630164116c2b68de31a439231dc468ddcbee9f74cca511df1036a22ea Network… |
| sha256 | e8deebe849f80654b53b73d41a379919a86c4c356715d34729335e79089127c7 | 450619fec6befdf92c5171298e3651ed6f06a5a637f8a5afc407f monex e8deebe849f80654b53b73d41a379919a86c4c356715d34729335e79089127c7 secure d4fed9ca90249707099926e336c0ec5abc0be8fbeb0e1889f725 |
| sha256 | fb3995289bac897e881141e281c18c606a772a53356cc81caf38e5c6296641d4 | 7836c273763827e1680856ec6d53bd73bbc4a03e9f743eddfc53cf68789 fb3995289bac897e881141e281c18c606a772a53356cc81caf38e5c6296641d4 46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467 |
From the original article
12 min read at unit42.paloaltonetworks.com
Unit 42 researchers recently discovered activity attributed to Mispadu Stealer, a stealthy infostealer first reported in 2019. We found this activity as part of the Unit 42 Managed Threat Hunting offering. We discovered this threat activity while hunting for the SmartScreen CVE-2023-36025 vulnerability.
By Daniela Shalev, Josh Grunzweig · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.