Palo Alto Networks observed mass-distribution campaigns of
The attachementts are zip, 7-zip, gz and rar archives, the emails contains subject lines, message text and attachements. Attackers use to change the attachement names constantly and refered to finacial issues.
Researchers found 3,845 email sessions attached with
If no exception occurs the executable drops a DLL in the temp directory and assigns a random file name under C:ProgramData directory. It creates a scheduled task to make it persistent and executed everytime when users logged in.
Following are the Redaman Banking Malware Capabilities
- Downloading files to the infected host
- Keylogging activity
- Capture screen shots and record video of the Windows desktop
- Collecting and exfiltrating financial data, specifically targeting Russian banks
- Smart card monitoring
- Shutting down the infected host
- Altering DNS configuration through the Windows host file
- Retrieving clipboard data
- Terminating running processes
- Adding certificates to the Windows store
Once the infection completed the traffic will be sent to command and control (C2) sever and a small amount of traffic return form C2 server to the infected DLL client.
“We found over 100 examples of malspam during the last four months of 2018, and this blog provides a closer look at Redaman during that timeframe.”