Hook : New Android banking trojan

In January 2023, ThreatFabric initially identified Hook, categorizing it as a “variant of ERMAC” available for purchase at a monthly rate of $7,000. These variants stem from the efforts of a malware author known as DukeEugene.

Hook extends the functionality of ERMAC with more features, supporting up to 38 additional commands compared to the latter.

ERMAC’s primary functionalities were crafted to include sending SMS messages, overlaying a phishing window atop legitimate applications, listing installed apps, gathering SMS messages, and retrieving recovery phrases for numerous cryptocurrency wallets.

Conversely, Hook takes an advanced approach, going beyond by live-streaming the victim’s screen and actively engaging with the user interface to secure complete control over the compromised device. It even captures images using the front camera, acquires cookies associated with Google login sessions, and pilfers recovery codes from additional cryptocurrency wallets.

Additionally, it has the capability to send SMS messages to multiple phone numbers, effectively propagating the malware to other users.

Despite these distinctions, both Hook and ERMAC are proficient in capturing keystrokes and exploiting Android accessibility services for overlay attacks, which enable them to overlay content on other applications and pilfer credentials from more than 700 apps. The roster of target applications is continuously acquired through dynamic requests to a remote server.

Malicious software families are also engineered to monitor clipboard events and substitute the copied content with an attacker-controlled wallet if the victim copies a genuine wallet address.

Most of the control and command (C2) servers for Hook and ERMAC are situated in Russia, with additional servers found in the Netherlands, the United Kingdom, the United States, Germany, France, Korea, and Japan.

As of April 19, 2023, the Hook project appears to have ceased, with DukeEugene announcing his departure for a “special military operation.” Another individual under the alias RedDragon will handle software support until customers’ subscriptions expire.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post The new Android banking trojan is based on ERMAC appeared first on First Hackers News.

MOVEit Transfer

The software at the center of the recent massive Clop ransomware breach, MOVEit Transfer, has been updated to address a critical SQL injection bug along with two additional vulnerabilities of lesser severity.

The SQL injection vulnerabilities enable attackers to manipulate queries in order to gain unauthorized access to a database or manipulate its contents by executing malicious code. These attacks exploit the absence of adequate input/output data sanitization in the targeted application.

The two SQL injection security issues impact various versions of MOVEit Transfer, including:

• Versions 12.1.10 and earlier
• Versions 13.0.8 and earlier
• Versions 13.1.6 and earlier
• Versions 14.0.6 and earlier
• Versions 14.1.7 and earlier
• Versions 15.0.3 and older.

The second SQL injection flaw, identified as CVE-2023-36932, received a high severity rating because an attacker could exploit it after authentication.

A third vulnerability addressed by this patch is CVE-2023-36933, a high severity issue that allows attackers to cause an unexpected program termination.

In response to the significant impact of the security incident, the American software company has made the decision to implement a proactive measure by introducing monthly security updates known as “Service Packs.”

This new approach enhances the software upgrade process, enabling MOVEit Transfer administrators to apply fixes more efficiently and promptly than previous methods.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post MOVEit Transfer customers are being warned to fix a new, critical flaw appeared first on First Hackers News.

What is QBOT ?

Qakbot, which was first detected in 2007, has since grown into a multi-purpose malware with multiple functionalities, including tools for performing reconnaissance, exfiltrating data and delivering other payloads. Its modular nature gives it flexibility for keeping up with the evolving threat landscape, and the malware has recently seen growing popularity among a variety of threat groups that either use its various capabilities or any of its second-stage payloads.

Attackers deploying the malware have previously relied on hijacked email threads (harvested in bulk from Microsoft ProxyLogon).Researchers said at least 4,500 spam emails have been sent in this wave of attacks, which they first observed April 4.

“The malware would be delivered through e-mail letters written in different languages — variations of them were coming in English, German, Italian, and French,” said Victoria Vlasova, Andrey Kovtun and Darya Ivanova, researchers with Kaspersky in a monday report.

“After the WSF file is deobfuscated, its true payload gets revealed: a PowerShell script encoded into a Base64 line,” Kaspersky wrote. “As soon as the user opens the WSF file from the archive, the PowerShell script will be discreetly run on the computer and use wget to download a DLL file from a remote server.”

 Kaspersky has also observed some Qbot versions turning victims’ computers into proxy servers to facilitate traffic redirection.

Qbot indicators of compromise

MD5
PDF files
253E43124F66F4FAF23F9671BBBA3D98
39FD8E69EB4CA6DA43B3BE015C2D8B7D

ZIP archives
299FC65A2EECF5B9EF06F167575CC9E2
A6120562EB673552A61F7EEB577C05F8

WSF files
1FBFE5C1CD26C536FC87C46B46DB754D
FD57B3C5D73A4ECD03DF67BA2E48F661

DLL
28C25753F1ECD5C47D316394C7FCEDE2

Malicious links
ZIP archive
cica.com[.]co/stai/stai.php
abhishekmeena[.]in/ducs/ducs.php

DLL
rosewoodlaminates[.]com/hea/yWY9SJ4VOH
agtendelperu[.]com/FPu0Fa/EpN5Xvh
capitalperurrhh[.]com/vQ1iQg/u6oL8xlJ
centerkick[.]com/IC5EQ8/2v6u6vKQwk8
chimpcity[.]com/h7e/p5FuepRZjx
graficalevi.com[.]br/0p6P/R94icuyQ
kmphi[.]com/FWovmB/8oZ0BOV5HqEX
propertynear.co[.]uk/QyYWyp/XRgRWEdFv
theshirtsummit[.]com/MwBGSm/lGP5mGh

Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post New QBot Banking Trojan Campaign Hijacks Business Emails to Spread Malware appeared first on First Hackers News.