Malware

Bizarro

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Bizarro is distributed via MSI packages downloaded by victims from links in spam emails.

T1566.002Spearphishing LinkEvidence1

Bizarro is distributed via MSI packages downloaded by victims from links in spam emails.

Execution

2 techniques

T1059.003Windows Command ShellEvidence1

The first thing the backdoor does is remove the DNS cache by executing the ipconfig /flushdns command.

T1204User ExecutionEvidence1

Bizarro is distributed via MSI packages downloaded by victims from links in spam emails. Once launched, Bizarro downloads a ZIP archive from a compromised website.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The malware developers have used obfuscation to complicate code analysis. The code of the exported functions have been removed by the protector. The bytes that belong to the exported functions are restored by the DLL entry point function at runtime.

T1036MasqueradingEvidence1

The downloaded ZIP archive contains the following files: A malicious DLL written in Delphi; A legitimate executable that is an AutoHotkey script runner (in some samples AutoIt is used instead of AutoHotkey); A small script that calls an exported function from the malicious DLL.

Credential Access

2 techniques

T1056Input CaptureEvidence1

Bizarro has x64 modules and is able to trick users into entering two-factor authentication codes in fake pop-ups. It may also use social engineering to convince victims to download a smartphone app.

T1056.001KeyloggingEvidence1

Commands that log keystrokes Bizarro supports two commands that are responsible for keylogging. The COZUMEL command starts the logging process, while the COZUMARIA command stops it.

Discovery

2 techniques

T1010Application Window DiscoveryEvidence1

The malware does this by enumerating all the windows, collecting their names. Whitespace characters, letters with accents and non-letter symbols such as dashes are removed from the window name strings. If a window name matches one of the hardcoded strings, the backdoor continues starting up.

T1082System Information DiscoveryEvidence1

Bizarro gathers the following information about the system on which it is running: Computer name; Operating system version; Default browser name; Installed antivirus software name.

Collection

4 techniques

T1056Input CaptureEvidence1

Bizarro has x64 modules and is able to trick users into entering two-factor authentication codes in fake pop-ups. It may also use social engineering to convince victims to download a smartphone app.

T1056.001KeyloggingEvidence1

Commands that log keystrokes Bizarro supports two commands that are responsible for keylogging. The COZUMEL command starts the logging process, while the COZUMARIA command stops it.

T1113Screen CaptureEvidence1

Having sent the data to the telemetry server, Bizarro initializes the screen capturing module. It loads the magnification.dll library and gets the address of the deprecated MagSetImageScalingCallback API function. With its help, the Trojan can capture the screen of a user

T1115Clipboard DataEvidence1

With its help, the Trojan can capture the screen of a user and also constantly monitor the system clipboard, looking for a Bitcoin wallet address. If it finds one, it is replaced with a wallet belonging to the malware developers.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

Once launched, Bizarro downloads a ZIP archive from a compromised website.

T1219Remote Access ToolsEvidence1

Commands that allow attackers to control the user’s mouse and keyboard... command performs a left mouse button click... double click... right mouse button click... moves the mouse to a designated location. Bizarro can also manipulate the user’s keyboard

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securelistNews

May 13, 2021

Bizarro banking Trojan expands its attacks to Europe | Securelist

Brazilian banking trojan that targets online banking customers, steals credentials, captures screens, monitors and replaces Bitcoin wallet addresses in the clipboard, logs keystrokes, kills browser sessions, disables autocomplete, displays fake banking pop-ups to harvest 2FA codes, and can socially engineer victims into installing a malicious Android app.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Bizarro

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Bizarro is distributed via MSI packages downloaded by victims from links in spam emails.

T1566.002Spearphishing LinkEvidence1

Bizarro is distributed via MSI packages downloaded by victims from links in spam emails.

Execution

2 techniques

T1059.003Windows Command ShellEvidence1

The first thing the backdoor does is remove the DNS cache by executing the ipconfig /flushdns command.

T1204User ExecutionEvidence1

Bizarro is distributed via MSI packages downloaded by victims from links in spam emails. Once launched, Bizarro downloads a ZIP archive from a compromised website.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence1

Credential Access

2 techniques

T1056Input CaptureEvidence1

Bizarro has x64 modules and is able to trick users into entering two-factor authentication codes in fake pop-ups. It may also use social engineering to convince victims to download a smartphone app.

T1056.001KeyloggingEvidence1

Commands that log keystrokes Bizarro supports two commands that are responsible for keylogging. The COZUMEL command starts the logging process, while the COZUMARIA command stops it.

Discovery

2 techniques

T1010Application Window DiscoveryEvidence1

T1082System Information DiscoveryEvidence1

Bizarro gathers the following information about the system on which it is running: Computer name; Operating system version; Default browser name; Installed antivirus software name.

Collection

4 techniques

T1056Input CaptureEvidence1

Bizarro has x64 modules and is able to trick users into entering two-factor authentication codes in fake pop-ups. It may also use social engineering to convince victims to download a smartphone app.

T1056.001KeyloggingEvidence1

Commands that log keystrokes Bizarro supports two commands that are responsible for keylogging. The COZUMEL command starts the logging process, while the COZUMARIA command stops it.

T1113Screen CaptureEvidence1

T1115Clipboard DataEvidence1

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

Once launched, Bizarro downloads a ZIP archive from a compromised website.

T1219Remote Access ToolsEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securelistNews

May 13, 2021

Bizarro banking Trojan expands its attacks to Europe | Securelist

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.