Grandoreiro malware resurfaces, targeting 60+ countries and 1,500 banks with advanced features. Learn about its sophisticated evasion and phishing techniques.
Continue reading
The resurgence of the Grandoreiro malware signifies a grave threat in the cybersecurity landscape. Initially disrupted by a significant law enforcement operation in January 2024, this Android banking trojan has not only returned but has evolved with enhanced features and capabilities. This Threatfeed meticulously dissects the technical intricacies of Grandoreiro, examining its distribution, technical revamps, and implications for the cybersecurity industry.
In January 2024, an international law enforcement operation involving Brazil, Spain, Interpol, ESET, and Caixa Bank aimed to dismantle the Grandoreiro malware network. This malware had been active since 2017, primarily targeting Spanish-speaking countries, and was responsible for $120 million in losses. The operation led to five arrests and thirteen search and seizure actions across Brazil, although specifics about the arrested individuals' roles remain undisclosed.
The coordinated efforts temporarily disrupted Grandoreiro's operations, significantly impacting its reach and effectiveness. However, the respite was short-lived as the malware resurfaced in March 2024, indicating that key members of the operation had evaded capture.
IBM's X-Force team reported that Grandoreiro has re-emerged, likely through a Malware-as-a-Service (MaaS) model. This model enables multiple threat actors to rent the malware, broadening its scope and increasing its resilience against takedown efforts. The rental model has facilitated its spread to over 60 countries, targeting approximately 1,500 banks, including those in English-speaking countries.
The latest phishing campaigns are highly sophisticated. Emails impersonate government entities in Mexico, Argentina, and South Africa, using official logos and formats to lend credibility. These emails, written in the recipient's native language, prompt users to click links to view invoices or tax documents. Upon clicking, users are redirected to an image of a PDF that triggers the download of a ZIP file containing a bloated (100 MB) executable, which is the Grandoreiro loader.
The Grandoreiro malware has undergone significant technical enhancements, making it more evasive and potent:
The string decryption algorithm now employs a combination of AES CBC and a custom decoder, enhancing the malware's ability to obfuscate its operations and evade detection.
Updates to the domain generation algorithm (DGA) include multiple seeds, enabling more sophisticated command and control (C2) communications. This update allows for better separation of operator tasks, complicating detection efforts.
A new mechanism targets Microsoft Outlook clients, disabling security alerts and using them to propagate phishing emails to new targets. This exploitation broadens the malware's reach and effectiveness.
Grandoreiro now relies on creating registry Run keys (`HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run` and `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run`) for persistence. This ensures the malware remains active even after system reboots.
The malware's targeting scope has expanded to include not only banking applications but also cryptocurrency wallets. This diversification increases its potential impact.
The command set has been expanded to include remote control, file upload/download, keylogging, and browser manipulation via JavaScript commands. This expansion provides operators with greater control and versatility.
Grandoreiro now performs detailed victim profiling to determine whether to execute on a device. This feature allows operators to selectively target victims, enhancing the malware's effectiveness and reducing the risk of detection.
The latest version of Grandoreiro avoids execution in specific countries such as Russia, Czechia, the Netherlands, and Poland, as well as on Windows 7 machines in the United States without active antivirus. This behavior suggests a strategic approach to avoid regions with robust cybersecurity defenses or significant law enforcement scrutiny.
The updated string decryption algorithm combines AES CBC with a custom decoder. Below is a simplified code snippet illustrating this process:
from Crypto.Cipher import AES
import base64
def decrypt_string(encrypted_string, key, iv):
cipher = AES.new(key, AES.MODE_CBC, iv)
decoded_data = base64.b64decode(encrypted_string)
decrypted_string = cipher.decrypt(decoded_data)
return decrypted_string.rstrip(b'\x00')
key = b'your16bytekeyhere'
iv = b'your16byteivhere'
encrypted_string = 'base64_encoded_encrypted_string_here'
decrypted_string = decrypt_string(encrypted_string, key, iv)
print(decrypted_string)The updated DGA employs multiple seeds to generate domain names. Here is a conceptual representation:
import hashlib
def generate_domain(seed, counter):
base_domain = 'example.com'
hash_object = hashlib.md5((seed + str(counter)).encode())
subdomain = hash_object.hexdigest()[:8]
return f"{subdomain}.{base_domain}"
seeds = ['seed1', 'seed2', 'seed3']
counter = 1
for seed in seeds:
domain = generate_domain(seed, counter)
print(domain)The persistence mechanism leverages registry Run keys. Below is a PowerShell script example to create these keys:
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Malware" -Value "C:\path\to\malware.exe" -PropertyType "String" -Force
New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Malware" -Value "C:\path\to\malware.exe" -PropertyType "String" -ForceThe enhanced evasion techniques, such as the reworked string decryption and updated DGA, make Grandoreiro more difficult to detect and analyze. Security professionals must adopt advanced behavioral analysis and anomaly detection techniques to counter these improvements.
The sophisticated phishing campaigns highlight the importance of user education and robust email filtering solutions. Organizations must ensure that employees are trained to recognize phishing attempts and that email security systems are capable of filtering out such threats.
The persistence mechanisms employed by Grandoreiro underscore the need for thorough system scans and registry monitoring. Security teams must implement comprehensive remediation strategies to ensure complete removal of the malware.
The detailed victim profiling capability allows operators to maximize their impact while minimizing risk. Security teams should focus on advanced threat detection systems that can identify and respond to such selective targeting.
The resurgence of the Grandoreiro malware, enhanced with sophisticated technical features, presents a significant challenge to the cybersecurity community. Despite the recent law enforcement crackdown, the malware has not only returned but has become more formidable. This analysis underscores the need for continuous vigilance, advanced threat detection, and comprehensive user education to combat this evolving threat effectively. The technical advancements in Grandoreiro illustrate the dynamic nature of cyber threats and the necessity for adaptive and proactive cybersecurity measures.
A single ClickFix infrastructure is pushing StealC, Amatera, Remus, NetSupport, CastleLoader and a new loader called ResiLoader through fake Google/Cloudflare checks.
