Another common theme is spoofing emails to make them look like they came from VIVO, Brazils largest telecommunications company.

Countless security reports have detailed a plethora of nefarious activities linked to Brazilian threat actors, who mainly target the financial and private sector.

After India and China, Brazil is the worlds third worst botnet infected country, according to The Spamhaus Project.

This blog shows the pervasiveness of these Brazilian-made malware, which target online banking customers of over 60 banks in nearly a dozen countries throughout Latin America, Spain and Portugal.

This blog continues research presented in our earlier blog and maps the evasive infection and delivery methods used by Brazilian threat actors in order to distribute malware.

Antivirus vendors have assigned this type of malware generic names like: Banload, Banbra, Bancos, Boleto, Delf and Spy.Banker.

Despite the variation in the final malware payload, Cybereason identified three key stages that were common to most of the attacks involving Brazilian financial malware.

By implementing various evasive techniques, the attackers successfully bypass signatureheuristic-based engines, thus ensuring the delivery of the final malware.

While the multi-stage delivery approach is not new in cybercrime, its adoption by Brazilian threat actors has proven to be highly effective at evading many anti-virus products, as demonstrated by the low detection rate presented in our research.

We observed different types of Brazilian malware being used in conjunction by the same threat actor.

This finding gives us a glimpse into the different ways in which threat actors can capitalize on previously gained foothold, in order to increase their potential profits.

Other countries targeted in recent campaigns include Mexico, Argentina, Venezuela, Colombia, Bolivia and Chile.

We observed references to more than 60 banks embedded within the malwares code.

See the list of targeted banks in this section ).

While the identity of the author is known, there is no proof that this author has a direct link to the financial malware discussed in this blog.

Cybereason estimates that the publicly-available source code was repurposed by different threat actors who later added banking modules as well as anti-analysis features, that were present in the financial malware analyzed in this blog.

However, there seems to be a basic formula that most infections adhere to.

The email body usually contains either a link or an attachment (pdf, zip, batch script, html) that will fetch or run the first stage downloader.

The downloader often points to a shortened URL that redirects to a Web hosting service, dynamic DNS or CDN to fetch the second stage payload.

In some cases the second stage downloader has additional functionality, such as creating persistence and performing anti-analysis checks.

The configuration is either embedded in the binary or downloaded from a command-and-control server.

Most payloads are Windows executable binaries, developed in Delphi.

This technique seems to bypass many network security products, antivirus programs and may even evade some security analysts.

The email body usually contains either an attachment or a link to a URL shortener that points to hosting websites where the first stage payload is stored.

Edx Loader.Rar