Delf.EP Trojan steals online banking passwords (Mar 25, 2011).
The Sonicwall UTM research team received reports of a new online banking Trojan in the wild. The Trojan’s sole purpose is to steal security credentials used to manage various online banking accounts. The Trojan targets sites such as paypal, mastercard and citibank. The Trojan is targeted exclusively at brazilian users but can also affect users from other countries.
The Trojan’s activity once it has compromised a machine is quite simple. It makes only a single modification to the file system once it has run.
The Trojan makes the following POST and GET requests to a remote webserver:
The Trojan downloads a hosts.txt from the remote webserver and places it at:
- C:WINDOWSsystem32driversetchosts
The hosts file contains the following data:
69.162.122.215 www.bb.com.br69.162.122.215 bb.com.br69.162.122.215 www.bancobrasil.com.br69.162.122.215 bancobrasil.com.br69.162.122.215 www.bancodobrasil.com.br69.162.122.215 bancodobrasil.com.br69.162.122.215 americanexpress.com.br69.162.122.215 www.americanexpress.com.br69.162.122.215 bancoamazonia.com.br69.162.122.215 www.bancoamazonia.com.br69.162.122.215 bancodaamazonia.com.br69.162.122.215 www.bancodaamazonia.com.br69.162.122.215 citibank.com.br69.162.122.215 www.citibank.com.br69.162.122.215 credicard.com.br69.162.122.215 www.credicard.com.br69.162.122.215 hotmail.com.br69.162.122.215 www.hotmail.com.br69.162.122.215 login.live.com69.162.122.215 live.com69.162.122.215 naotempreco.com.br69.162.122.215 www.naotempreco.com.br69.162.122.215 mastercard.com69.162.122.215 www.mastercard.com69.162.122.215 mastercard.com.br69.162.122.215 www.mastercard.com.br69.162.122.215 itau.com.br69.162.122.215 www.itau.com.br69.162.122.215 bancoitau.com.br69.162.122.215 www.bancoitau.com.br69.162.122.215 itaupersonnalite.com.br69.162.122.215 www.itaupersonnalite.com.br69.162.122.215 personnalite.com.br69.162.122.215 www.personnalite.com.br69.162.122.215 pagseguro.com.br69.162.122.215 www.pagseguro.com.br69.162.122.215 pagseguro.com69.162.122.215 www.pagseguro.com69.162.122.215 pagseguro.uol.com.br69.162.122.215 www.pagseguro.uol.com.br69.162.122.215 paypal.com69.162.122.215 www.paypal.com69.162.122.215 paypal.com.br69.162.122.215 www.paypal.com.br69.162.122.215 bradesco.com.br69.162.122.215 www.bradesco.com.br69.162.122.215 bradesco.com69.162.122.215 www.bradesco.com69.162.122.215 bancobradesco.com.br69.162.122.215 www.bancobradesco.com.br69.162.122.215 bancobradesco.com69.162.122.215 www.bancobradesco.com69.162.122.215 bradescoprime.com.br69.162.122.215 www.bradescoprime.com.br69.162.122.215 bancobradescoprime.com.br69.162.122.215 www.bancobradescoprime.com.br69.162.122.215 bancobradescoprime.com69.162.122.215 www.bancobradescoprime.com69.162.122.215 bradescoprivatebank.com.br69.162.122.215 www.bradescoprivatebank.com.br69.162.122.215 bradescoprivatebank.com69.162.122.215 www.bradescoprivatebank.com69.162.122.215 serasa.com.br69.162.122.215 www.serasa.com.br69.162.122.215 serasaexperian.com.br69.162.122.215 www.serasaexperian.com.br69.162.122.215 serasa.com69.162.122.215 www.serasa.com69.162.122.215 serasaexperian.com69.162.122.215 serasaexperian.com.br69.162.122.215 bancoreal.com.br69.162.122.215 www.bancoreal.com.br69.162.122.215 real.com.br69.162.122.215 www.real.com.br69.162.122.215 santander.com.br69.162.122.215 www.santander.com.br69.162.122.215 bancosantander.com.br69.162.122.215 www.bancosantander.com.br69.162.122.215 internetbanking.caixa.gov.br69.162.122.215 www.caixa.com.br69.162.122.215 www.caixa.gov.br69.162.122.215 www.caixaeconomica.com.br69.162.122.215 www.caixaeconomica.gov.br69.162.122.215 www.caixaeconomicafederal.com.br69.162.122.215 www.caixaeconomicafederal.gov.br69.162.122.215 www.cef.com.br69.162.122.215 www.cef.gov.br69.162.122.215 caixa.com.br69.162.122.215 caixa.gov.br69.162.122.215 caixaeconomica.com.br69.162.122.215 caixaeconomica.gov.br69.162.122.215 caixaeconomicafederal.com.br69.162.122.215 caixaeconomicafederal.gov.br69.162.122.215 cef.com.br69.162.122.215 cef.gov.brThis hosts file causes all of the above sites to point to the IP address of a malicious web server (69.162.122.215). The malicious web server hosts a copy of pages at each of the original sites listed above. It should be noted that none of the redirected sites use the HTTPS protocol for secure communication.
The screenshot below shows a non-https brazilian copy of paypal.com hosted on the malicious webserver:
Upon entering the username and password the following messagebox is displayed:
The screenshot below shows the default malicious page loaded for mastercard.com. This page requests credit card information in order to obtain certain benefits:
Upon submitting the requested information the following page is displayed:
Translation:
Congratulations, your MasterCard was successfully registered in our database!Now you compete for prizes every month up to $ 500,000.00 (Five Hundred Thousand Dollars), and $ 50.00 each inpurchases made with your MasterCard, you earn 01 point to exchange for goods or servicesour partners.Warning: Though it was already participating in, your login will be released only after the next billing cycle. SonicWALL Gateway AntiVirus provid
es protection against this threat via the following signature:
- GAV: Delf.EP (Trojan)
