Rewterz Threat Alert – Grandoreiro Banking Trojan Takes Over Device for Fraudulent Transactions

Severity

Medium

Analysis Summary

The Grandoreiro banking malware uses remote overlay and a fake Chrome browser plugin to steal from banking customers. The trojan has been targeting banks in Brazil and  Latin America, and is now expanding its targets to more countries including Spain. The attack uses COVID-19-themed videos to trick users into running a concealed executable, infecting devices with a remote-access. The trojan is capable of overtaking devices and displaying a full-screen overlay image when victim accesses their online banking account. Meanwhile, the attacker initiates a fraudulent money transfer from the compromised account in the background. 

The attack flow is the usual malspam to trick users into clicking a URL that takes them to a malicious website. Victims are then persuaded to download a .MSI file from a Github repository, which is actually the malware loader. The Grandoreiro payload is then fetched via a hardcoded URL within the loader’s code. After download, Grandoreiro establishes a connection with its command-and-control (C2) server, which allows the malware to send notifications about machine information and facilitate remote access capabilities to the attacker when a victim accesses a banking site. One unique technique utilized by Grandoreiro’s operators is the download of a malicious extension for the Google Chrome browser. This extension pretends to be a “Google Plugin” version 1.5.0., and is added as a visually square button to the browser window.

The extension asks victims for various permissions, including reading victim browsers’ history, displaying notifications, modifying data that’s copied and pasted and more. This extension may be grabbing the victim’s cookies to use them from another device to ride the victim’s active session. 

Impact

• Unauthorized Remote Access
• Device Takeover
• Theft of banking credentials
• Financial fraud

Indicators of Compromise

MD5

• 0ec58f736218541045fac6990e182700
• caace6841a4ca5fde5c67e676d140ade
• 3b5aacd9d64072186ca2f9867fea6c4b

SHA-256

• 3bbd2beaa7953543e3cfb09d064db83b11034ff81255429b82e2de40d661ee29
• 08710023c219f26237a9c8de5454a1de17117a2da651b4391afce8e331f31dfa
• 6ea983202a84b929ff95959e4e7167c7bcd5466ee21b0cddf0fe0d8badeabb32

Source IP

• 13[.]72[.]105[.]98

Remediation

• Block the threat indicators at their respective controls.
• Do not respond to untrusted emails and do not click on untrusted URLs even if they look harmless. 
• Be very careful while granting permissions to applications and extensions.