{"id":660,"date":"2024-06-20T18:08:25","date_gmt":"2024-06-20T18:08:25","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=660"},"modified":"2024-06-20T18:08:25","modified_gmt":"2024-06-20T18:08:25","slug":"red-mongoose-daemon-a-new-banking-trojan-identified-in-may-2024-by-scilabs","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2024\/06\/20\/red-mongoose-daemon-a-new-banking-trojan-identified-in-may-2024-by-scilabs\/","title":{"rendered":"Red Mongoose Daemon: a new banking trojan identified in May 2024 by SCILabs"},"content":{"rendered":"

\"\"<\/h1>\n

Red Mongoose Daemon: a new banking trojan<\/em><\/strong><\/p>\n

Overview<\/h1>\n

The purpose of this document is to describe TTPs and provide indicators of compromise related to a new banking trojan that SCILabs identified during May through a threat monitoring and hunting in LATAM and named Red Mongoose Daemon.<\/em><\/p>\n

The main objective of Red Mongoose Daemon<\/em> is to steal victims’ banking information by spoofing PIX<\/a> transactions through overlapping windows. This trojan is aimed at Brazilian end users and employees of organizations with banking information.<\/p>\n

SCILabs was unable to identify the distribution method of this threat, however, based on its experience and the name of the files used in the identified campaign, such as \u201cApelacao_Processo-NNYN.msi<\/strong>\u201d, \u201cProcesso-judicial.B9WU<\/strong>\u201d, and \u201cPedido_Faturado. -WJVUC<\/strong>\u201d, to mention a few, it is likely that the distribution method is through malicious emails using invoices and legal issues as pretexts, just like it is common in the activity of banking trojans in LATAM such as Grandoreiro<\/em> and URSA\/Mispadu<\/em>.<\/p>\n

How could Red Mongoose Daemon impact organizations?<\/h1>\n

Red Mongoose Daemon <\/em>can steal banking information from all types of users, including organization employees. Additionally, it has command execution capabilities, as well as advanced anti-analysis and persistence methods that will be described later, which increase the possibility of successful attacks. If an attack is successful within an organization, cybercriminals can leak or sell the stolen information in clandestine Dark Web forums or on the black market, putting at risk the confidentiality, integrity, and availability of the information, leading to financial and reputation losses.<\/p>\n

Analysis<\/h1>\n

Threat Context<\/h2>\n

During May, through a threat monitoring in the region, SCILabs identified a malicious file compressed in ZIP format. Upon conducting the analysis, TTPs different from those of other trojans discovered and reported by SCILabs were identified, such as the use of the legitimate tool Daemon Tools<\/a>, and the creation and pseudo-random modification of directories for their persistence; that is how it was given the name of Red Mongoose Daemon<\/em>.<\/p>\n

SCILabs was unable to identify the distribution method for this campaign. However, \u00a0being common in banking trojan campaigns in LATAM, phishing emails are likely to be used under the guise of supposed invoices, legal matters, and tax notes. These emails mostly contain embedded URLs that redirect the victim to sites for automatic downloading of ZIP-type files, which contain MSI files named after the pretext used, for example, \u201cApelacao_Processo-NNYN.msi<\/strong>.\u201d<\/p>\n

Because the names of the artifacts found were written in Portuguese and it is the Brazilian payment system PIX which the trojan attempts to impersonate, with a high confidence level, SCILabs determined that this campaign is aimed at Brazilian users.<\/p>\n

During the investigation, SCILabs identified some overlaps with the Javali\/Ousaban<\/em> banking trojan, which are have general characteristics such as the appearance of some C2 Endpoints (shown below in Figure 1) and capabilities such as the manipulation of windows of the operating system (this technique is used by the majority of LATAM banking trojans); however, the infection chain, which will be detailed later, and the DLL of the trojan, in comparison with Javali\/Ousaban<\/em> campaigns.<\/p>\n

Based on the above, SCILabs has the hypothesis that the threat actors behind Red Mongoose Daemon <\/em>are also the operators of Javali\/Ousaban<\/em> and will continue monitoring them.<\/p>\n

\"\"<\/p>\n

Figure 1. (1 – Top) Template used by Javali\/Ousaban<\/em> operators to query infected machines, (2 – Bottom) Template used by Red Mongoose Daemon<\/em> operators with the same objective<\/p>\n

Technical summary<\/h2>\n

The identified MSI file is named \u201cApelacao_Processo-NNYN.msi<\/strong>\u201d and corresponds to the first Red Mongoose Daemon <\/em>dropper. The infection chain begins if the victim executes it.<\/p>\n

\"\"<\/p>\n

Figure 2. First Dropper<\/p>\n

 <\/p>\n

The MSI file contains the following artifacts:<\/p>\n

 <\/p>\n