InfoSecBulletin Cybersecurity for mankind
Banking Trojan developers are always finding new ways to spread malware and infect victims. Kaspersky found a new malware that targets users of over 60 banks in Brazil. It caught the attention because of its advanced infection method using various technologies, different from known banking Trojan infections.
The malware uses the Squirrel installer to spread and uses NodeJS and a newer programming language called Nim as a loader to infect systems. Kaspersky named this new Trojan “Coyote” because coyotes hunt squirrels. The Nim language is described as a “statically typed compiled systems programming language that combines successful concepts from mature languages like Python, Ada, and Modula.” The use of less popular and cross-platform languages by cybercriminals is a trend we identified in the report on Crimeware and financial cyberthreats for 2024.
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
By infosecbulletin
/ Wednesday , January 22 2025
Fortinet customers must apply the latest updates, as almost 50,000 management interfaces remain vulnerable to the latest zero-day exploit. The...
Read More
Daily Security Update Dated: 21.01.2025
By infosecbulletin
/ Tuesday , January 21 2025
Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems
By infosecbulletin
/ Tuesday , January 21 2025
Ubuntu 22.04 LTS users are advised to update their systems right away due to a crucial security patch from Canonical...
Read More
CERT-UA alerts about “security audit” requests through AnyDesk
By infosecbulletin
/ Tuesday , January 21 2025
Attackers are pretending to be Ukraine's Computer Emergency Response Team (CERT-UA) using AnyDesk to access target computers. “Unidentified individuals are...
Read More
Oracle Critical Pre-Release update addressed 320 flaw
By infosecbulletin
/ Tuesday , January 21 2025
Oracle Critical Patch Update Pre-Release Announcement shares details about the upcoming update scheduled for January 21, 2025. Note that this...
Read More
OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025
By infosecbulletin
/ Tuesday , January 21 2025
OWASP has released its updated list of the top 10 vulnerabilities in smart contracts for 2025. This guide highlights the...
Read More
Multiple Azure DevOps Vulns Allow To Inject CRLF Queries & Rebind DNS
By infosecbulletin
/ Monday , January 20 2025
Security researchers have found several vulnerabilities in Azure DevOps that could enable attackers to inject CRLF queries and carry out...
Read More
Intel holds 22 employees from one Bangladeshi University
By infosecbulletin
/ Monday , January 20 2025
Intel Corporation is a leading semiconductor chip manufacturer, employing at least 22 graduates from the Department of Applied Chemistry and...
Read More
VPN Surge 1500% in USA after TikTok Shut Down
By infosecbulletin
/ Sunday , January 19 2025
vpnMentor’s Research Team is monitoring the potential TikTok ban in the U.S., driven by national security and data privacy issues....
Read More
MITRE Launches D3FEND 1.0; The Milestone for Cybersecurity Ontology
By infosecbulletin
/ Saturday , January 18 2025
MITRE launched D3FENDTM 1.0, a cybersecurity framework that provides a vocabulary and understanding of the cyber domain. D3FEND 1.0, funded...
Read More
Forget old Delphi and MSI:
Banking Trojans often utilize the Delphi language or MSI installers as a common method for initial infection. This is a well-known trend among malware creators in the cybersecurity community.
Coyote does things a little differently. Instead of going down the usual route with MSI installers, it opted for a relatively new tool for installing and updating Windows desktop applications: Squirrel. As the authors explain, “Squirrel uses NuGet packages to create installation and update packages, which means that you probably already know most of what you need to create an installer.”
By using this tool, Coyote hides its initial stage loader by presenting it as an update packager.
The Node.js loader script:
When Squirrel is used, it runs a NodeJS application with Electron. This application runs obfuscated JavaScript code (preload.js). Its main task is to copy all executable files from a local folder named temp to the user’s captures folder in the Videos folder. Afterward, it runs a signed application from that folder.
The team found several executables being used, such as Chrome and OBS Studio. The banker is loaded by sideloading a DLL dependency of these executables. In all cases, the libcef.dll library is used for DLL sideloading. Click here to read the full report.
Source: Securelist
