Banking Trojan masquerading as Chrome installer
Brazilian and Peruvian users looking to install Google’s Chrome browser are in grave danger of downloading information-stealing malware instead.
“We recently found some suspicious looking URLs which suggest that a malicious file named ChromeSetup.exe is hosted in domains like Facebook and Google,” Trend Micro researchers warn.
Most of the domains in question seem to be tied to Brazil, as they misuse its country code top-level domain (.br), but all of them redirect to two other IP addresses from which they download the malicious file, which is actually a multi-component banking Trojan.
Once downloaded and run, the malware contacts a C&C server to which it sends information about the the IP address and OS of the infected machine, and from which it downloads a configuration file that is used to redirect users to realistically spoofed banking sites when they are trying to visit the legitimate ones:
Users can notice the switch only if they pay attention to the real URL of the site and if the spot the “_” before the name in the window title.
Another component of the Trojan manages to uninstall GbPlugin, a software used to protect Brazilian bank customers when they perform online banking transactions. It’s interesting to note that the deinstallation is performed by a legitimate tool originally created for uninstalling malicious software.
By analyzing the C&C panel before the server became inaccessible, they researchers discovered that some 3000 machines have been infected with the banking Trojan in a time span of mere three hours.
Further analysis showed that different variants of the same Trojan were pushed out in the wild, and that the cyber crooks behind this scheme have been at it for quite a while.
“While we may have a complete picture of this particular attack, the one missing piece now is the same thing that made us notice this malware from the millions of data that we have from our threat intelligence – how it is able to redirect user accesses from normal websites like Facebook or Google to its malicious IP to download malware,” the researchers concluded, and promised to continue their investigation into the matter.