astaroth-deobfuscator

astaroth-deobfuscator 用于反混淆 Astaroth/Guildma 注入器 DLL 的 IDA Python 脚本 在尝试分析近期 Astaroth/Guildma 攻击活动中使用的注入器 DLL 时（感谢 SANS ISC 的这篇日记），我遇到了一个 极其 烦人的混淆手段。 有一个函数（我在下图中将其命名为 timewaster3000）在整个 DLL 中被调用了 1,000 多次（!!!）。该函数将六个硬编码字符串作为参数，外加一个随机的 word。就我目前所知，这个函数本身就是一个毫无实际用途的算术无底洞（除了浪费逆向工程师的时间）。以下是在这些烦人的调用存在...

Watch Out! New Android Banking Trojan Steals From 112 Financial Apps

Four months after security researchers uncovered a "Tetrade" of four Brazilian banking Trojans targeting financial institutions in Brazil, Latin America, and Europe, new findings show that the criminals behind the operation have expanded their tactics to infect mobile devices with spyware...

Ghimob: a Tétrade threat actor moves to infect mobile devices

Guildma, a threat actor that is part of the Tétrade family of banking trojans, has been working on bringing in new techniques, creating new malware and targeting new victims. Recently, their new creation, the Ghimob banking trojan, has been a move toward infecting mobile devices, targeting...

Brazil's Banking Trojans Go Global

Malware that is typically used in Brazil is expanding its geography, targeting users in North America, Europe and elsewhere in Latin America. Banking trojans, which steal online banking logins and other financial credentials from unsuspecting victims, are fairly common – but the more sophisticate...

4 Dangerous Brazilian Banking Trojans Now Trying to Rob Users Worldwide

Cybersecurity researchers on Tuesday detailed as many as four different families of Brazilian banking trojans that have targeted financial institutions in Brazil, Latin America, and Europe. Collectively called the "Tetrade" by Kaspersky researchers, the malware families — comprising Guildma,...

The Tetrade: Brazilian banking malware goes global

Introduction Brazil is a well-known country with plenty of banking trojans developed by local crooks. The Brazilian criminal underground is home to some of the worlds busiest and most creative perpetrators of cybercrime. Like their counterparts in China and Russia, their cyberattacks have a stron...