{"id":838,"date":"2024-12-04T16:10:55","date_gmt":"2024-12-04T16:10:55","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=838"},"modified":"2024-12-04T16:10:55","modified_gmt":"2024-12-04T16:10:55","slug":"operation-saci-observed-during-november-2024","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2024\/12\/04\/operation-saci-observed-during-november-2024\/","title":{"rendered":"Operation Saci, observed during november 2024"},"content":{"rendered":"\n

<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Overview<\/strong><\/h1>\n\n\n\n

The following report aims to provide indicators of compromise, along with the technical tactics and procedures associated with a malware campaign named by SCILabs as Operation Saci<\/em>, which was identified during the second week of November 2024 through ongoing threat monitoring and hunting activities in Latin America.<\/p>\n\n\n\n

After conducting an investigation, SCILabs observed that the Grandoreiro<\/em> and URSA\/Mispadu<\/em> malware families are being distributed through Operation Saci<\/em>. Given the impersonated institution (Citibanamex) and the impacted banks, it is highly likely that the installed banking Trojan is targeting Mexico.<\/p>\n\n\n\n

Operation Saci<\/em>‘s distribution method is phishing emails, which may contain a hyperlink or an attached PDF file, using pretexts related to invoices, pending payment receipts, or payment vouchers. Its main objective is to distribute the Grandoreiro<\/em> and URSA\/Mispadu<\/em> malware families, which aim to steal banking information from users of different financial institutions through the overlapping of windows. In the case of some URSA\/Mispadu<\/em> installations, they may also steal browser history, Outlook credentials, and SMTP access.<\/p>\n\n\n\n

It is important to mention that, during this investigation, SCILabs found different overlaps between various aspects of the Grandoreiro<\/em> and URSA\/Mispadu<\/em> infection chain. First, the Grandoreiro<\/em> infection will be addressed broadly (as it represents the final stage in this specific campaign) before highlighting the similarities between both attack flows and describing them in detail.<\/p>\n\n\n\n

<\/p>\n\n\n\n

How could it affect an organization?<\/strong><\/h1>\n\n\n\n

The malware families distributed by Operation Saci<\/em> can steal banking and confidential information (such as browsing history and Outlook credentials) from all types of users, including employees of public and private entities. If an attack is successful within the organization, cybercriminals may leak or sell the stolen information in clandestine Dark Web forums or black markets, compromising the confidentiality, integrity and availability of the data, and leading to potential financial and reputational losses for clients.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Analysis<\/strong><\/h1>\n\n\n\n

General context of the threat<\/h2>\n\n\n\n

During the second week of November 2024, through ongoing threat monitoring and hunting activities in Latin America, SCILabs identified an email containing an attached PDF file \u2014protected by a password included in the same email\u2014 named after the victim’s email address. The email  uses the pretext an alleged payment receipt to  impersonate Citibanamex. It was determined, with a high level of confidence that this specific campaign is targeted at Mexico.<\/p>\n\n\n\n

\"Figure<\/figure><\/div>\n\n\n\n

Figure 1. Visual appearance of the attached PDF file<\/strong><\/p>\n\n\n\n

\"Figure<\/figure><\/div>\n\n\n\n

Figure 2. Phishing email visual appearance<\/strong><\/p>\n\n\n\n

Technical summary of Grandoreiro\u2019s<\/em> installation process<\/strong><\/h2>\n\n\n\n

The PDF file contains an embedded hyperlink. When the victims click on it, they are redirected to a site where a file named \u201c\u2749\ud835\udd38\ud835\udd63\ud835\udd54\ud835\udd59\ud835\udd5a\ud835\udd67\ud835\udd60\ud835\udd64\u2749_\u2460\u2460\u2468\u2463\u2460\u2460<\/strong>,\u201d in ZIP format is automatically downloaded. However, those numbers vary with each download.<\/p>\n\n\n\n

\"Figure<\/figure><\/div>\n\n\n\n

Figure 3. Visual appearance of the automatic download site<\/strong><\/p>\n\n\n\n

The ZIP contains a file in HTA format (with the same name as the compressed file) which includes the instructions to download and execute a JavaScript script.<\/p>\n\n\n\n

\"Figure<\/figure><\/div>\n\n\n\n

Figure 4. Content of the compressed file<\/strong><\/p>\n\n\n\n

\"Figure<\/figure><\/div>\n\n\n\n

Figure 5. Code fragment contained in the HTA file<\/strong><\/p>\n\n\n\n

Furthermore, as an additional defense evasion mechanism, the malware displays an alleged password validator, typical of other malware families like URSA\/Mispadu<\/em>.<\/p>\n\n\n\n

\"Figure<\/figure><\/div>\n\n\n\n

Figure 6. Password validator used by Grandoreiro<\/em> in this campaign<\/strong><\/p>\n\n\n\n

After the validation, the second stage of the infection begins. The script named 6725c86d7fa55.js<\/strong> is responsible for downloading an additional dropper in VBS format installed within the %PUBLIC%<\/em> directory.<\/p>\n\n\n\n

\"Figure<\/figure><\/div>\n\n\n\n

Figure 7. Code fragment contained in the JavaScript file<\/strong><\/p>\n\n\n\n

This dropper performs the following tasks:<\/p>\n\n\n\n