Incidents

Wave of VBE files leading to financial fraud

Old tricks never die, and bad guys know that. We recently saw a big wave of malicious VBE files targeting Brazilian users, distributed via email messages. Most of the files are downloaders which, after they are executed, try to install a series of badness that goes from traditional banking Trojans to RATs to Boleto malware.

The attack started with messages like the one below, with a .ZIP file attached to the message. Some messages show only links to download the VBE file directly, using a variety of topics, such as the release of Windows 10. As you can see, the file is very small (less than 1KB) but inside is where the badness lives:

1

This message was sent to “Malicioso”, a mailbox where our Latin American users can send suspicious content

It’s interesting to see how mail servers still don’t block this kind of file attached to messages – all the bad guys need to do is to put the malicious file inside a ZIP or RAR and magically the message will arrive in the user’s mailbox:

2

Yes, Outlook.com still accept VBE/VBS files inside a ZIP

Not surprisingly the VBE file attached to the ZIP file is encoded:

3

Bad guys are using all kinds of encoding, in an effort to avoid detection by AV products – although most are using simple Base64 provided by Motobit software. Some are also using a commercial encoding solution, even using a demo copy:

4

After decoding the file we can see their real intention; this one downloads and installs Boleto malware, which is very typical for Brazil:

5

These malware families are detected by our product using two verdicts. Recently there has been a big increase in both  in Brazil, as illustrated by the numbers for Trojan-Downloader.VBS.Agent:

6

And there were almost 12,000 detection of Trojan-Downloader.VBS.Banload in just one day:

7

Looking at our stats worldwide, we can see that Brazil, Portugal and Spain are the most attacked countries by the VBS.Banload family this month. Not surprisingly, Brazil always leads all the rankings regarding Banking Trojan infections, even where they use a very old technique. The reason why the bad guys decide to use this is because they are still effective for some users.

8

Our users are protected against this kind of attack: our heuristic detection blocks most of them. Here are some MD5s of the files we detect: http://pastebin.com/Qpb6v6PQ

Wave of VBE files leading to financial fraud

Your email address will not be published. Required fields are marked *

 

Reports

Operation TunnelSnake

A newly discovered rootkit that we dub ‘Moriya’ is used by an unknown actor to deploy passive backdoors on public facing servers, facilitating the creation of a covert C&C communication channel through which they can be silently controlled. The victims are located in Africa, South and South-East Asia.

APT trends report Q1 2021

This report highlights significant events related to advanced persistent threat (APT) activity observed in Q1 2021. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports.

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Subscribe to our weekly e-mails

The hottest research right in your inbox