Win32/BackSwap.A

The banker is distributed through malicious email spam campaigns that carry an attachment of a heavily obfuscated JavaScript downloader from a family commonly known as Nemucod.

Once banking activity is detected, the malware injects malicious JavaScript into the web page, either via the browser’s JavaScript console or directly into the address bar.

The malware starts by copying itself into a startup folder in order to ensure persistence and then proceeds with its banking functionality.

The injected scripts secretly replace the recipient’s bank account number with a different one and when the victim decides to send the wire transfer, the money will be sent to the attackers instead. Any safeguards against unauthorized payment, such as 2-factor authorization, won’t help in this case, as the account owner is willingly sending the wire transfer.

The malware starts by copying itself into a startup folder in order to ensure persistence and then proceeds with its banking functionality.

The payload is delivered as a modified version of a legitimate application that is partially overwritten by the malicious payload. The application used as the target for the modification is being changed regularly – examples of apps misused in the past include TPVCGateway, SQLMon, DbgView, WinRAR Uninstaller, 7Zip, OllyDbg, and FileZilla Server.

The malware inserts the malicious script into the clipboard and simulates pressing the key combination for opening the developer’s console... followed by CTRL+V... and then sends ENTER... In the newer variants... The malware simply simulates pressing CTRL+L to select the address bar... then “types” in “javascript:” by calling SendMessageA in a loop... It then executes the script by sending the ENTER key.

The injected scripts secretly replace the recipient’s bank account number with a different one and when the victim decides to send the wire transfer, the money will be sent to the attackers instead. Any safeguards against unauthorized payment, such as 2-factor authorization, won’t help in this case, as the account owner is willingly sending the wire transfer.

It handles everything by working with Windows GUI elements and simulating user input... The malware monitors the URL currently being visited by installing event hooks for a specific range of relevant events available through the Windows message loop, such as EVENT_OBJECT_FOCUS, EVENT_OBJECT_SELECTION, EVENT_OBJECT_NAMECHANGE and a few others.

The injected scripts secretly replace the recipient’s bank account number with a different one and when the victim decides to send the wire transfer, the money will be sent to the attackers instead. Any safeguards against unauthorized payment, such as 2-factor authorization, won’t help in this case, as the account owner is willingly sending the wire transfer.

The malware inserts the malicious script into the clipboard and simulates pressing the key combination for opening the developer’s console... followed by CTRL+V... and then sends ENTER... In the newer variants... The malware simply simulates pressing CTRL+L to select the address bar... then “types” in “javascript:” by calling SendMessageA in a loop... It then executes the script by sending the ENTER key.

It handles everything by working with Windows GUI elements and simulating user input... The malware monitors the URL currently being visited by installing event hooks for a specific range of relevant events available through the Windows message loop, such as EVENT_OBJECT_FOCUS, EVENT_OBJECT_SELECTION, EVENT_OBJECT_NAMECHANGE and a few others.

In older samples, the malware inserts the malicious script into the clipboard and simulates pressing the key combination for opening the developer’s console... followed by CTRL+V, which pastes the contents of the clipboard.

In older versions, the attackers were retrieving the receiving bank account numbers from C&C servers that were hosted on hacked WordPress websites.