Emerging Matrix Banker Trojan is targeting banks in Latin America

Security Experts at Arbor Networks have spotted a new banking trojan, initially called ‘Matrix Banker’, that is targeting Latin America. Malware researchers at Arbor Networks have spotted a new banking trojan, initially called ‘Matrix Banker’, that is targeting Latin America. The malicious code seems to be still under development, most of the victims were located […]

June 13, 2017

Security Experts at Arbor Networks have spotted a new banking trojan, initially called ‘Matrix Banker’, that is targeting Latin America.

Malware researchers at Arbor Networks have spotted a new banking trojan, initially called ‘Matrix Banker’, that is targeting Latin America.

The malicious code seems to be still under development, most of the victims were located in Mexico and Perù.

“Initially, we’ve called it “Matrix Banker” based on its command and control (C2) login panel, but it seems that “Matrix Admin” is a template available for the Bootstrap web framework. Proofpoint calls it “Win32/RediModiUpd” based on a debugging string from an earlier sample.” states Arbor Networks.

The initial loader for Matrix Banker Trojan gains persistence through Registry Run, it extracts and injects a DLL into most popular Internet Browser, including Chrome, Firefox, Internet Explorer or Edge.

The main DLL is injected in a browser to hook browser functions and run a Man-In-the-Browser attack.

“Once the main DLL is injected in a browser, it starts by hooking the appropriate browser functions (e.g. PR_Read and PR_Write for Firefox) to setup a “man-in-the-browser” (MitB).” states the report. “It then phones home to its C2 server to get the webinject config. The request looks like this:”

The malware then contacts the C&C server to get the webinject config.

Matrix Banker trojan

Matrix Banker is the first malware that encodes the and encrypts response from the C&C server with the Salsa20 crypto algorithm.

Salsa20 is an unpatented stream cipher developed by Daniel Bernstein, it is the same algorithm used by the Petya ransomware to encrypt victims’ Master File Table.

“While functional, the webinject format looks to be under construction.” state the report. “Earlier samples use a different, simpler format and there is plenty of work to do to catch up with the industry standard Zeus webinjects.”

Experts noticed the malware uses a very difficult and effective redirection to a phishing page that looks like a perfect copy of the targeted bank’s login page.”

Researchers believe it is not possible in this phase to predict the impact of the malware on a large-scale, the unique certainty is that the threat is actively being developed and targeting financial institutions in the wild.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Matrix Banker, malware)

[adrotate banner=”13″]