Rewterz Threat Alert – Amavaldo – A Latin American Banking Trojan Causing Financial Loss

Severity

Medium

Analysis Summary

A malware family they have named Amavaldo, and focus on two campaigns they observed which targeted Mexico and Brazil. ESET have identified a number of characteristics typical of Latin American banking Trojans which includes, that they are written in Delphi, contain backdoor functionality, use long distribution chains, functionality may involve multiple components, abuse legitimate tools and software, make persistent connections to C&C servers, use little-known cryptographic algorithms, and target Spanish or Portuguese speaking countries. Latin American banking Trojans tend to use social engineering techniques rather than web-injection to steal money from victims. Infected systems are monitored for certain activity which presents an opportunity for the attackers to launch their social engineering attacks. In the past, Amavaldo had been used to target Brazilian users, but in April 2019, began to be used in attacks against Mexican users. The Amavaldo family is modular malware and the final payload ZIP file consists of three components, an executable file which is a copy of a legitimate application, an injector DLL and an encrypted banking Trojan. Amavaldo collects certain information from the victim system, newer versions communicate with the C&C server using the Delphi SecureBridge library. The beginning of the infection chain is an MSI installer, in the case of the campaign targeting Mexico, ESET believe spam emails may have been the distribution vector.

Impact

• Financial loss
• Exposure of sensitive information

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

• E0C8E11F8B271C1E40F5C184AFA427FFE99444F8
• 12C93BB262696314123562F8A4B158074C9F6B95
• 6D80A959E7F52150FDA2241A4073A29085C9386B
• B855D8B1BAD07D578013BDB472122E405D49ACC1
• FC37AC7523CF3B4020EC46D6A47BC26957E3C054
• 4DBA5FE842B01B641A7228A4C8F805E4627C0012
• 9A968341C65AB47BF5C7290F3B36FCF70E9C574B
• AD1FCE0C62B532D097DACFCE149C452154D51EB0
• 6C04499F7406E270B590374EF813C4012530273E
• B191810094DD2EE6B13C0D33458FAFCD459681AE
• B80294261C8A1635E16E14F55A3D76889FF2C857

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the link/ attachments sent by unknown senders.