XPCTRA

The infection vector (malspam) links to a supposed PDF invoice, which actually leads the victim to download an executable file (dropper);

The malspams used in the campaign try to induce the victim to open a supposed bank bill link. It actually leads to the download of the XPCTRA dropper... Once executed, it initiates a connection with an Internet address to download other malware parts

Installs the Fiddler root certificate to prevent the user from receiving digital certificate errors;

XPCTRA, as I call today’s variant, in addition to banking data, steals online digital wallet users’ credentials from services such as Blockchain.info and PerfectMoney.

Instantiates “Fliddler”, an HTTP Proxy that is used to monitor and intercept user access to the financial institutions; ... Monitors and captures user credentials while accessing the websites of 2 major Brazilian banks and other financial institutions;

Once executed, the dropper downloads a “.zip” file, unzips and executes the malware payload;

In v1.3, once a client connects to a server, authentication is performed. After that, the main body of data including the commands are exchanged. On the other hand, the authentication is replaced by a TLS handshake in v1.4, and the data exchange begins after that.

Instantiates “Fliddler”, an HTTP Proxy that is used to monitor and intercept user access to the financial institutions; Points Internet Browsers settings to the local proxy (Fiddler);

Once executed, the dropper downloads a “.zip” file, unzips and executes the malware payload;

Quasar [1] is an open source RAT (Remote Administration Tool) with a variety of functions. This is easy to use and therefore exploited by several APT actors.

Stolen credentials are sent to criminals through an unencrypted C&C channel;

Changes Firewall policies to allow the malware to communicate unrestrictedly with the Internet;