{"id":735,"date":"2024-10-02T17:24:17","date_gmt":"2024-10-02T17:24:17","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=735"},"modified":"2024-10-02T17:24:17","modified_gmt":"2024-10-02T17:24:17","slug":"new-banking-trojan-silver-oryx-blade-activity-observed-in-may-2024","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2024\/10\/02\/new-banking-trojan-silver-oryx-blade-activity-observed-in-may-2024\/","title":{"rendered":"New Banking trojan Silver Oryx Blade Activity observed in August 2024"},"content":{"rendered":"

Overview<\/strong><\/h2>\n

This post aims to describe the TTPs and provide indicators of compromise related to a new banking trojan, which SCILabs named Silver Oryx Blade<\/em>. Its main characteristics are the compromise of infrastructure, such as malware repositories, Minecraft<\/a> video game servers, and the combination of different programming languages \u200b\u200bduring the infection. SCILabs identified this threat in August 2024 through monitoring and threat hunting in LATAM.<\/p>\n

The main objective of Silver Oryx Blade<\/em> is to steal banking information from Brazilian users by monitoring the banking sites that they access through their web browsers.<\/p>\n

This trojan’s distribution method is phishing emails, which use tax matters and supposed salary bonuses as pretexts. Those emails impersonate the Brazilian Ministry of Finance and the finance departments of organizations in that country.<\/p>\n

SCILabs has identified the use of libraries such as WatsonTCP<\/a> in Silver Oryx Blade<\/em>, as well as the application of AES encryption in some chains (features that have also been utilized by the Coyote<\/em><\/a> trojan). Furthermore, a domain used in the Silver Oryx Blade<\/em> campaign was identified during the investigation, which is possibly related to a Coyote<\/em> campaign. However, the differences in the TTPs and artifacts used in the infection chain are significant. Therefore, SCILabs has the hypothesis, with a medium level of confidence, that this new banking trojan is being distributed by the same malware operators.<\/p>\n

 <\/p>\n

\"\"
Figure 1. Banking trojan Silver Oryx Blade<\/strong><\/figcaption><\/figure>\n

How could it affect an organization?<\/strong><\/h2>\n

Silver Oryx Blade<\/em> can steal banking information from all types of users, including employees of organizations. Additionally, it has command execution capabilities, and some artifacts used in the infection chain have a low detection rate in antivirus engines on the VirusTotal<\/a> platform, increasing the likelihood of successful attacks. If an attack succeeds within an organization, cybercriminals could leak or sell the stolen information on clandestine Dark Web forums or the black market, jeopardizing the organization’s information’s confidentiality, integrity, and availability, resulting in financial and reputational <\/a>losses.<\/p>\n

Analysis<\/strong><\/h2>\n

Threat Context<\/strong><\/h2>\n

In August 2024, SCILabs identified a malicious MSI file compressed in ZIP format through proactive threat monitoring in the region. Upon analysis, different TTPs from previously reported trojans by SCILabs were detected, like plain text payloads, which are undetectable by antivirus engines on the VirusTotal<\/a> platform, along with other techniques described later.<\/p>\n

Through retro hunt techniques, SCILabs identified that this trojan’s distribution method is through phishing emails (targeting Brazilian users) which use pretexts such as alleged salary bonuses, PIX transfers<\/a>, and fiscal notices, impersonating HR finance departments and the Ministry of Finance of Brazil.<\/p>\n

\"\"
Figure 2. Example of a phishing email using a salary bonus pretext<\/strong><\/figcaption><\/figure>\n
\"\"
Figure 3. Example of a phishing email using a fiscal notice pretext<\/strong><\/figcaption><\/figure>\n
\"\"
Figure 4. Example of a phishing email using a supposed PIX transfer<\/strong><\/figcaption><\/figure>\n

The threat actors behind this campaign use email spoofing<\/a> to send malicious emails, impersonating the senders. During the analysis of one such email, the domain milkdavaca[.]com<\/strong> was identified and tagged by a user<\/a> on the VirusTotal platform as part of the Coyote<\/em> trojan\u2019s infrastructure due to its use of the same SSL certificate and registrant. So far, the domain is still protected by the Withheld for Privacy<\/a>[3]<\/a> service. This finding suggests that the operators of Coyote<\/em> and Silver Oryx Blade<\/em> might be the same.<\/p>\n

Most emails contain embedded URLs that redirect victims to sites that automatically download ZIP files. These ZIP files contain MSI droppers with names that simulate legitimate documents, such as PDFs (e.g. pdf.mes168.msi), office files (e.g. Ofic.01194.msi), or company names with a presence in Brazil, like VISU (e.g. visu.96178215.msi). The variety of these artifact names indicates that, in addition to the pretexts and impersonated institutions, the operators adapt the lures to the sociocultural context of the target country, in this case, Brazil \u2014 a common tactic in Latin American banking trojans.<\/p>\n

During the investigation, SCILabs discovered that the operators of this malware use link shorteners like bit[.]ly and file storage platforms like ufile[.]io, as well as compromised sites like a Minecraft game server<\/a>, which was used around May 2024 to distribute the malware.<\/p>\n

\"\"
Figure 5. Use of ufile[.]io to distribute Silver Oryx Blade<\/strong><\/figcaption><\/figure>\n
\"\"
Figure 6. Minecraft server appearance used to distribute Silver Oryx Blade around May 2024<\/strong><\/figcaption><\/figure>\n

\u00a0<\/span><\/p>\n

It is essential to highlight that SCILabs identified some overlaps with the Coyote<\/em> banking trojan. These include general features like using specific libraries like WatsonTCP and AES-encrypted<\/a> strings; however, the infection chain (detailed below) and the trojan show substantial differences compared to the Coyote<\/em> campaigns previously reported by SCILabs, and investigations published in open sources.<\/a><\/p>\n

Technical Summary<\/strong><\/h2>\n

The file downloaded from the phishing email’s embedded URLs is an MSI file with various names, such as “pdf.mes168.msi<\/strong>,” “visu.96178215.msi<\/strong>“, or “Ofic.01194.msi<\/strong>,” among others. These files correspond to the first dropper of Silver Oryx Blade<\/em>.<\/p>\n

\"\"
Figure 7. First MSI dropper<\/strong><\/figcaption><\/figure>\n

The MSI file contains the following artifacts:<\/p>\n

\"\"
Figure 8. Contents of the first dropper<\/strong><\/figcaption><\/figure>\n

 <\/p>\n