New Financial Malware 'JanelaRAT' Targets Latin American Banks and Crypto Users

Breaking: JanelaRAT Malware Campaigns Surge Across Latin America

A sophisticated Trojan named JanelaRAT is actively stealing financial and cryptocurrency data from users in Latin America, according to new threat intelligence released today. The malware, which has been operational since June 2023, specifically targets data from major banks and financial institutions in the region. Kaspersky experts warn that the threat actors behind JanelaRAT are continuously updating their techniques.

New Financial Malware 'JanelaRAT' Targets Latin American Banks and Crypto Users — Source: securelist.com

Background

JanelaRAT takes its name from the Portuguese word for 'window,' a nod to its custom title bar detection mechanism. This feature sets it apart from its predecessor, BX RAT, by allowing the malware to identify specific websites in victims' browsers and then execute malicious actions. Kaspersky solutions detect JanelaRAT as Trojan.Script.Generic and Backdoor.MSIL.Agent.gen.

Infection Chain: From Fake Invoice to Full Compromise

Initial infection begins with phishing emails that mimic pending invoice delivery, tricking recipients into clicking a malicious link that leads to a compromised website. From there, a compressed file is downloaded, typically containing VBScripts, XML files, ZIP archives, and BAT files. These components ultimately deliver a ZIP archive designed for DLL sideloading, deploying JanelaRAT as the final payload.

'The attackers are constantly evolving to evade detection,' said a Kaspersky security researcher. In the latest campaigns, the infection chain has evolved to integrate MSI files, which act as a streamlined dropper. 'We are seeing a logical progression where the number of installation steps is reduced, making the attack quicker and harder to trace,' the researcher added.

Initial Dropper and Persistence

The MSI file acts as an initial dropper, obfuscating file paths and names to hinder analysis. It uses ActiveX objects to manipulate the file system and execute malicious commands, establishing persistence on the infected system. The dropper creates shortcuts in the startup folder and stores a first-run indicator to avoid re-infection.

What This Means

Users in Latin America face an elevated risk of financial theft from these targeted attacks. The malware's ability to stay under the radar by frequently updating its infection chain means traditional defenses may not suffice. Experts urge strong anti-malware solutions, caution against clicking suspicious email links, and recommend verifying invoice requests through official channels. 'Vigilance is key,' the Kaspersky researcher emphasized. 'Organizations should also monitor for unusual DLL sideloading activity.'

New Financial Malware 'JanelaRAT' Targets Latin American Banks and Crypto Users

Breaking: JanelaRAT Malware Campaigns Surge Across Latin America

Background

Infection Chain: From Fake Invoice to Full Compromise

Initial Dropper and Persistence

What This Means

Related Articles

Recommended

Discover More