Some Russian campaign running
over leaked email spreads different kind of malware. Today on Yahoo mail
has come some fresh Ursnif with 0 detections. | The domain used for my email was inactive and there was no file for download, but I found it somewhere else. In the pictures below will find the research steps: Was easy to find a sample of malware using the SHA256 (d6c0ca87f712c0633eab5ac020ceaad2e256cd3251808ce7c7b45faf4042123e) on Google. The
.zip file is detected and this may be an advantage for the users IF
they are using the Antivirus that have on his database this sample… but
this is another discussion… At this moment the VirusTotal says 18/57.. so is going to be better in a few hours. Now.. extracting them one by one we have a good
encrypted malware named Ursnif (GOZI/ ISFB). This malware is trying to
steal baking credentials from his victims and the hacker may have access
to the system. I will not explain the whole process at this time but the way to do that you will find it on the recent post I’ve made: https://www.prodefence.org/malware-analysis-gozi-ifsb-bank-trojan-aka-ursnif/
Useful links: Urlscan with samples VirusTotal .zip VirusTotal .js VirusTotal .bin
Network traffic: In the same way it is using the /POST request for sending stealed data, when the victim visits some bank account, paypal…etc. Botnet host directory and login page:
H**p://xxx.xxx/adminpanel/admin.php
The remove is easy. You just have to follow the path’s to find the droped executables and delete the created registers.
Alexandru Anghelus – Malware analyst & investigator
Security of your personal data is very important.
Also sensitive Company data is extremely important.
If you’ve got a file and it looks suspicious, do not open it.
The .zip, .exe, .rtf, .doc, .htm, .rar … etc files can be infected and
personal data may become public or can be used against you.
With my analysis services you can remove that insecurity!
Analyzing a file can take a few minutes or even hours.
Investigating the ones found and drawing up the report may take longer, depending on the infected file.
Tracking the hacker may be impossible or may take several days.
Chances of success in discovering the infected file are 99%.
Full report services can help identify the reason, the target and whether it is a direct or random attack.
At the following address you can find some of my work in the field.
I am malware analyst and investigator.
With my skills everyone can have a clear vision about some suspicios files or emails that they have on pc.
I am the founder of Professional Defence Community, a 7 years cybersecurity website.
Web Pentesting.
Malware analysis.
Malware investigator.
