{"id":901,"date":"2025-03-13T16:30:10","date_gmt":"2025-03-13T16:30:10","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=901"},"modified":"2025-03-13T16:30:10","modified_gmt":"2025-03-13T16:30:10","slug":"golden-jaguar-new-threat-discovered-by-scilabs","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2025\/03\/13\/golden-jaguar-new-threat-discovered-by-scilabs\/","title":{"rendered":"Golden Jaguar, new threat discovered by SCILabs"},"content":{"rendered":"\n
\"\"<\/figure><\/div>\n\n\n\n

OVERVIEW<\/strong><\/h1>\n\n\n\n

This report aims to describe the TTPs and provide indicators of compromise related to a new banking trojan observed by SCILabs  and named Golden Jaguar<\/em>. Some of its characteristics include the use of legitimate executables associated with Microsoft Edge and Google Chrome, and the exposure of stolen information through  socket <\/a>openings and keyboard monitoring.<\/p>\n\n\n\n

Golden Jaguar<\/em>‘s main objective is stealing information from financial institutions such as Banco do Brasil and Banco Caixa (both from Brazil), among others, by monitoring the sites accessed by the victim through their web browser.<\/p>\n\n\n\n

SCILabs identified that this banking trojan is distributed through phishing emails, using alleged judicial matters as pretexts to impersonate the Juizado Especial C\u00edvel de S\u00e3o Paulo<\/em> (S\u00e3o Paulo Small Claims Court)<\/p>\n\n\n\n

Based on the research conducted and the malware analysis, SCILabs determined, with a high level of confidence, that the Golden Jaguar campaigns observed are directed at Brazil.<\/p>\n\n\n\n

It is important to note that, at the time of writing this document, some of the artifacts identified during the investigation and used in the Golden Jaguar<\/em> infection chain were not detected by some of the security solutions contained in the VirusTotal platform, which increases the risk of compromise for employees of different organizations, so companies must be alert to this threat.<\/p>\n\n\n\n

<\/p>\n\n\n\n

HOW COULD IT AFFECT AN ORGANIZATION?<\/strong><\/h1>\n\n\n\n

Golden Jaguar <\/em>can steal banking information belonging to all types of users, including organization employees. If an attack is successful within an organization, cybercriminals can leak or sell stolen information on underground forums on the Dark Web or the black market, putting their information’s confidentiality, integrity, and availability at risk and causing financial and reputational losses.<\/p>\n\n\n\n

<\/p>\n\n\n\n

ANALYSIS<\/h1>\n\n\n\n

Threat context<\/h2>\n\n\n\n

Between the first and second week of February 2025, SCILabs identified a phishing email using alleged judicial matters as a pretext to impersonate the Juizado Especial C\u00edvel de S\u00e3o Paulo, Brasil<\/em>. The email contains a hyperlink with the URL hxxps[:]\/\/127[.]175[.]153[.]160[.]host[.]secureserver[.]net\/gerar\/gera[.]php embedded in it, from which the victim obtains a file in VBS format.<\/p>\n\n\n\n

\"\"
Figure 1. Phishing email distributing Golden Jaguar <\/em>download URL<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n

The template displayed when clicking the hyperlink contained in the email or visiting the URL shows a message in Portuguese (pt-BR) informing the user that the download is being prepared; after 5 seconds, the victim gets the first Golden Jaguar<\/em> dropper, which uses the following regular expression as nomenclature, ^[a-f0-9]{6}-[a-f0-9]{8}-[a-f0-9]{3}$<\/strong>, for example ce7348-9df885d0-a4a.vbs.<\/p>\n\n\n\n

\"\"
Figure 2. Template used on Golden Jaguar<\/em> download site<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n

It is important to mention that the malicious site restricts downloading artifacts with the same name. Otherwise, a message is displayed, indicating that the file was not found or was deleted.<\/p>\n\n\n\n

\"\"
Figure 3. File not found or removed notice<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n

Technical resume<\/strong><\/h2>\n\n\n\n

By analyzing the source code of the download site, SCILabs identified that it is written in Portuguese (pt-BR), and the URL from which the first dropper is obtained is embedded within it.<\/p>\n\n\n\n

\"\"
Figure 4. Source code fragment from the download site<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n

The VBS file obtained by the victim is also written in Portuguese (pt-BR), with a message indicating that it is obfuscated for protection. When analyzing the code, SCILabs identified multiple segments separated into functions, each containing a series of integers separated by an asterisk, on which an XOR operation is applied with a key that can fluctuate between 15 and 100, according to the investigation.<\/p>\n\n\n\n

\"\"
Figure 5. Code snippet the first Golden Jaguar<\/em> dropper<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n

SCILabs deobfuscated the entire code, identifying that, in addition to the valuable fragments, it also contained multiple lines of \u201cjunk\u201d code intended to distract the attention of malware analysts.<\/p>\n\n\n\n

\"\"
Figure 6. Code snippet without functionality from the first dropper<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
Figure 7. Useful code snippet from the first dropper<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n

After separating the functional code from the non-essential code, SCILabs observed a reduction in size of at least 90 % of the original, identifying the following functionalities:<\/p>\n\n\n\n