Automatisk fjerningsguide for Reqg

Chaes banker’s large-scale campaign was discovered, during which about 800 WordPress sites were compromised. The Trojan mainly targets Brazilian users and uses five malicious extensions for the Chrome browser in its attacks.

Chaes activity was discovered av Avast eksperter, who report that a new malware campaign started at the end of 2021. I utgangspunktet, the malware was discovered back in 2020 av Cybereason analytikere, and then (as now) it was aimed at customers of Banco do Brasil, Loja Integrada, Mercado Bitcoin, Mercado Livre and Mercado Pago banks.

Now the researchers say the attack starts when the victim visits one of the hacked sites. There, the user sees a pop-up window asking to install a fake Java Runtime application.

innholdet i et slikt vindu lastes ned fra en ekstern server og plasseres i en WebView som imiterer utseendet til målprogrammet for å lure offeret

The MSI installer for thisappcontains three malicious files (install.js, sched.js, sucesso.js) that prepare the Python environment for the next stage loader. If the user follows the instructions, the malware initiates a complex bunker delivery procedure, which ends with the deployment of several modulesincluding spyware and remote-access module.

innholdet i et slikt vindu lastes ned fra en ekstern server og plasseres i en WebView som imiterer utseendet til målprogrammet for å lure offeret

Chays is characterized by multi-stage delivery, which involves environments such as JScript, Python and NodeJS, as well as binaries written in Delphi, and malicious extensions for Google Chrome. The ultimate goal of Chaes is to steal credentials stored in Chrome, as well as intercept logins and passwords from popular banking in Brazil. sier forskerne.

Some intermediate payloads are not only encrypted, but also hidden in commented code inside the HTML pages of the awsvirtual[.]blogspot.com domain. At the final stage of the attack, the JavaScript dropper downloads and installs up to five malicious Chrome extensions on the victim’s system:

  1. OnlineDelphi module used to fingerprint the victim and transfer system information to the hackerscontrol server;
  2. Mtps4 (MultiTela Pascal) is a Delphi-based backdoor, the main purpose of which is to connect to the control server and wait for the response Pascal Script to be executed;
  3. Chrolog (ChromeLog) – steals passwords from Google Chrome, the module is also written in Delphi;
  4. Chronodx (Chrome Noder) is a JavaScript Trojan that, upon detecting the launch of the Chrome browser, immediately closes it and opens its own instance of Chrome containing a malicious module that steals banking information;
  5. Chremows (Chrome WebSocket) is a banking JavaScript Trojan that intercepts keystrokes and mouse clicks in Chrome to steal credentials (for Mercado Livre and Mercado Pago users).
For tiden, the Chaes distribution campaign is still active and will continue until all compromised WordPress sites are secured. Avast analysts say that some of the sites that are used to deliver payloads are very popular in Brazil, so the number of infected systems is likely to be very high.

La meg minne deg på at vi også skrev det innholdet i et slikt vindu lastes ned fra en ekstern server og plasseres i en WebView som imiterer utseendet til målprogrammet for å lure offeret QakBot attacked over 17,000 brukere over hele verden, og også det Anubis Android Banker Targets Nearly 400 Brukere av finansielle apper.

Helga Smith

Jeg var alltid interessert i datavitenskap, spesielt datasikkerhet og temaet, som kalles i våre dager "datavitenskap", siden min tidlige tenåring. Før du kommer inn i Virusfjerningsteamet som sjefredaktør, Jeg jobbet som cybersikkerhetsekspert i flere selskaper, inkludert en av Amazons entreprenører. Nok en opplevelse: Jeg har undervisning på universitetene i Arden og Reading.

Legg igjen et svar

Denne siden bruker Akismet å redusere spam. Lær hvordan din kommentar data behandles.

Tilbake til toppen