Infamous Banking Malware Adds Email-Sending Feature

Cridex -- a.k.a. Feodo and Bugat -- now has a more streamlined and automated way of infecting victims and stealing their information.

A new version of an infamous banking worm comes with built-in stolen email account and server credentials for automatic email worm attacks to continue its spread.
The so-called Cridex data-stealing malware, a.k.a. Feodo and Bugat, now has a more streamlined and automated way of infecting victims, researchers at Seculert found. Once its on a victims machine, the new variant, dubbed Geodo by Seculert, downloads a second piece of malware that communicates with a command-and-control server. That second piece of malware is a worm that has 50,000 stolen SMTP email account credentials, including those of the associated SMTP servers.
Armed with those credentials, the malware sends out emails from legitimate accounts to other potential victims in an effort to continue its spread. Aviv Raff, CTO at Seculert, says this basically allows the infected bot to do the dirty work of infecting additional machines.
So far, the majority of the victims appear to be German speakers -- the emails are written mostly in German -- and 46% of the stolen credentials come from Germany.
Usually we see additional malware they download from some other attacker that uses the same machine, or additional components that add some capabilities to the malware itself. This is the first time Ive seen something that combines it, Raff says. This downloads something that itself it sends to new victims. Thats unique.
Seculert isnt sure from where the 50,000 stolen credentials were pilfered, but believes that the Cridex malware grabbed them. With the Geodo malware combination, a victim organization can also be at risk of its intellectual property being stolen, according to the firm.
Cridex traditionally had been known to spread via removable drives, but newer versions of the malware began arriving via Blackhole exploit kits, according to Trend Micro. There also are versions of the malware that use the domain generation algorithm (DGA) to keep its URLs moving targets from researchers and law enforcement.
Raff says the attackers dont appear to be a nation-state sponsored group, but they are out to steal as much information as they can from their victims. The actual malware is doing everything… stealing browser session files, etc. They usually take everything and then sell infected machines to other cybercriminals or nation-state spies.
Dell SecureWorks has also been watching the latest variant of the malware. We have looked at the latest iteration -- weve been calling it Bugat v4 -- but havent seen that particular plug-in downloaded yet. The malware has become more modular and there are different plugins delivered to different customers, so probably not all of them paid to get the spreader plugin, says Joe Stewart, director of malware research for Dell SecureWorks.
Stewart says the added email spreader and network sniffing are all things crimeware variants have used before. Its really just another step in the evolution of this malware that closely follows development patterns weve witnessed in the past.
Technical details and screen shots of the attack are available
here
from Seculert.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Infamous Banking Malware Adds Email-Sending Feature