Win32/BrobanDel

Installation

Threats in this family are usually distributed by malicious spam email attachments. The attachments are often zipped or contain double extensions. We have seen these threats using the following attachment file names:

• Contrato.cpl
• INTIMACAO-TRT-98822211.exe
• Nota_Fiscal_Eletronica_83773732.zip
• Planilha-Pendencias.doc_________.exe
• Visualizar_Processo_MPF_000874732666213.cpl

When the attachment is opened it downloads two malicious components to %APPDATA%.

The first component is detected as a variant of TrojanSpy:Win32/BrobanDel and collects email addresses from your PC. This stolen information could then be used for a spam email campaign. We have seen this component saved as:

• msv.exe
• msx.exe

Depending on your web browser, the second component installs either a Firefox or Chrome browser extension. This component is detected as a variant of TrojanSpy:JS/BrobanDel if it's a browser extension, or TrojanSpy:Win32/BrobanDel if the browser extension is embedded.

Payload

Installs malicious browser extensions

This malware checks to see which web browser is running on your PC.

If it detects the Firefox web browser it downloads a .xpi file that contains a malicious browser extension. For example, we have seen it download the following files:

• firefox.xpi
• morno.xpi
• nf.xpi
• numberchangerfirefox.xpi
• xpi.exe (contains an embedded .xpi file)

If the malware detects the Chrome web browser on your PC it downloads the following malicious browser extension components:

• comments.js
• content.js (contains the malicious code and is detected as a variant of TrojanSpy:JS/BrobanDel)
• jquery.js
• manifest.json
• replacer.js

Modifies Boleto payment information

This malware family targets Boleto Bancário - a common online payment method in Brazil.

It searches for specific patterns within webpages that match a Boleto identification number. When it detects a Boleto open in your web browser it sends the original Boleto information (such as Bank ID and payment value) to its command can control (C&C) server. It then requests an attacker-generated identification number and modifies the Boleto.

The new identification number contains the malicious hacker's designated bank account. When payment is made with the modified Boleto, the money is credited to the malicious hacker.

Analysis by Jeong Mun