Janeleiro

In some cases, malicious emails sent to targets contain links to a compromised server that redirects to the download of Janeleiro.

Their developers often distribute samples via phishing emails, sometimes casting a wide net and other times targeting specific individuals. These emails often masquerade as official correspondence related to tax or compliance matters, and occasionally attempt to impersonate government or tax agencies themselves.

Malicious emails are sent to companies in Brazil... An example of a phishing email is shown in Figure 1: a false notification regarding an unpaid invoice. It contains a link that leads to a compromised server.

Phishing emails sent by the attackers contain a link to download a ZIP archive that holds an MSI installer with Janeleiro malware.

Janeleiro achieves persistence by adding itself to the Run registry key (in v0.0.3 of the malware).

Janeleiro creates a LNK file for persistence (in v0.0.4, v0.0.2A and v0.0.2B of the malware).

Janeleiro achieves persistence by adding itself to the Run registry key (in v0.0.3 of the malware).

Janeleiro creates a LNK file for persistence (in v0.0.4, v0.0.2A and v0.0.2B of the malware).

Janeleiro v0.0.2B is obfuscated and its strings are RSA-encrypted. Version 0.0.3 uses AES for string encryption.

The attacker, in real time, receives screen captures, the logged keystrokes and information that is entered in the fake forms.

These pop-ups contain fake forms, aiming to trick the malware’s victims into entering their banking credentials and personal information that the malware captures and exfiltrates to its C&C servers.

Janeleiro v0.0.4 can download a DLL that obtains passwords stored in files from several applications such as FileZilla, Pidgin and Thunderbird.

Janeleiro v0.0.4 can download a DLL that steals passwords from Chrome, Firefox and Opera browsers.

Janeleiro begins enumerating windows and checking their titles to find interesting keywords... that would indicate that the user is visiting the website of a banking entity of interest.

Janeleiro collects the username from the victim’s machine.

If the geolocation check passes, Janeleiro gathers information of the compromised machine, including: Current date and time, Machine name and username, OS full name and architecture...

Janeleiro v0.0.4 can download a DLL that collects Gmail addresses.

Janeleiro collects current date and time when the victim is compromised.

The attacker, in real time, receives screen captures, the logged keystrokes and information that is entered in the fake forms.

These pop-ups contain fake forms, aiming to trick the malware’s victims into entering their banking credentials and personal information that the malware captures and exfiltrates to its C&C servers.

Janeleiro has been evolving towards the objective of giving more control to the operators... and recording user input and the screen in real time.

Janeleiro uses a clipboard event handler to access clipboard data.

Janeleiro uses TCP for C&C communications.

After that, Janeleiro retrieves the IP addresses of the C&C servers from a GitHub organization page apparently created by the criminals.

The purpose of the repository is to contain a file that has the list of IP addresses for Janeleiro’s C&C servers where it connects to report to its operators, to receive commands and to exfiltrate information in real time.