TechBizWebTechBizWeb

    Subscribe to Updates

    Get the latest news about Technology and Business from all around the web..

    What's Hot

    Ripple Labs Inc Floats CBDC Innovate Challenge

    June 29, 2022

    Trump-endorsed candidate clinches Republican nomination for Illinois governor

    June 29, 2022

    Pinterest has a new CEO, who has one job: to build the internet’s shopping mall

    June 29, 2022
    Facebook Twitter Instagram
    • About Us
    • Privacy Policy
    • Guest Post
    • Terms
    • Contact
    Facebook Twitter Instagram
    TechBizWebTechBizWeb
    Subscribe
    • Home
    • Technology

      Pinterest has a new CEO, who has one job: to build the internet’s shopping mall

      June 29, 2022

      Montblanc Summit 3 will be the first Wear OS 3 smartwatch for iOS

      June 29, 2022

      Gmail’s new look is about to appear for more people, even if they didn’t ask for it

      June 29, 2022

      Are Hyper’s stackable USB-C chargers melting?

      June 28, 2022

      Belkin’s MagSafe charging stand can now fast charge the Apple Watch Series 7

      June 28, 2022
    • Business
    • Cyber Security

      Hybrid work transition reveals low enterprise cybersecurity confidence

      June 28, 2022

      Ransomware in Q1 2022 doubled total 2021 volume

      June 28, 2022

      Lithuania hit by DDoS cyberattack

      June 28, 2022

      2 out of 3 European citizens welcome digital ID wallet

      June 28, 2022

      87% of executives have no cybersecurity tools on personal devices

      June 27, 2022
    • Blockchain
    • Vulnerabilities
    • Social Engineering
    • Malware
    • Cyber Security Alerts
    TechBizWebTechBizWeb
    Home»Cyber Security»Ongoing Campaign Delivers Redaman Banking Trojan
    Cyber Security

    Ongoing Campaign Delivers Redaman Banking Trojan

    January 24, 2019Updated:January 24, 2019No Comments3 Mins Read
    Facebook Twitter Pinterest LinkedIn Tumblr WhatsApp
    Share
    Facebook Twitter LinkedIn Pinterest Email


    Spam campaigns that have active during the last several months have been distributing the Redaman banking malware, Palo Alto Networks security researchers say. 

    First observed in 2015 and referred to as the RTM banking Trojan, the malware has been mainly used in attacks against recipients who conduct transactions using Russian financial institutions. Redaman is an updated version of RTM that initially emerged in 2017. 

    From September through December of 2018, Palo Alto Networks noticed the malware being served in Russian language mass-distribution campaigns. An ongoing malicious spam attack is currently distributing this threat to recipients worldwide. 

    The malspam targets Russian email recipients, often with email addresses ending in .ru. The emails carry archived Windows executable files disguised as a PDF document. The spam messages refer to a document or file for an alleged financial issue, attempting to trick the recipient into opening the attached archive.

    During the last four months of 2018, Palo Alto Networks security researchers found 3,845 email sessions with attachments tagged as Redaman. 

    The top 10 senders were Russia (3,456 sessions), Belarus (98), Ukraine (93), Estonia (29), Germany (30), United States (21), Netherlands (12), Great Britain (7), Switzerland (7), and Latvia (2). 

    The top 10 recipients were Russia (2,894), Netherlands (195), United States (55), Sweden (24), Japan (16), Kazakhstan (12), Spain (12), Finland (11), Germany (6), and Austria (4).

    When run, the Windows executable for Redaman checks for a series of files and directories on the local host and throws an exception and exits if any of those are found. This shows the malware verifies that it is not running in a sandbox or another type of analysis environment.

    If no exceptions occur, the executable drops a DLL file in the AppDataLocalTemp directory, then creates a folder under C:ProgramData and moves the DLL there. Persistence is achieved through a scheduled Windows task that ensures the DLL is executed at user logon. The executable then deletes itself. 

    The malware can monitor browser activity (Chrome, Firefox, and Internet Explorer), download files, log key strokes, capture screen shots/record video of the desktop, collect and exfiltrate financial data, monitor smart cards, shut down the host, modify DNS configuration, steal clipboard data, terminate running processes, and add certificates to the Windows store. 

    During infection, the threat periodically sent callback traffic to a command and control (C&C) server. Post infection, the server responded with a Pony variant DLL.

    “Since it was first noted in 2015, this family of banking malware continues targeting recipients who conduct transactions with Russian financial institutions. We found over 100 examples of malspam during the last four months of 2018. We expect to discover new Redaman samples as 2019 progresses,” Palo Alto Networks concludes. 

    Ionut Arghire is an international correspondent for SecurityWeek.

    Previous Columns by Ionut Arghire:
    Tags:



    Source link

    Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

    Related Posts

    Hybrid work transition reveals low enterprise cybersecurity confidence

    June 28, 2022 Cyber Security

    Ransomware in Q1 2022 doubled total 2021 volume

    June 28, 2022 Cyber Security

    Lithuania hit by DDoS cyberattack

    June 28, 2022 Cyber Security

    2 out of 3 European citizens welcome digital ID wallet

    June 28, 2022 Cyber Security

    87% of executives have no cybersecurity tools on personal devices

    June 27, 2022 Cyber Security

    CISA releases cloud security reference

    June 27, 2022 Cyber Security
    Editors Picks

    Trump-endorsed candidate clinches Republican nomination for Illinois governor

    June 29, 2022

    Pinterest has a new CEO, who has one job: to build the internet’s shopping mall

    June 29, 2022

    China’s Marxism majors prosper amid labour market woes

    June 29, 2022

    Montblanc Summit 3 will be the first Wear OS 3 smartwatch for iOS

    June 29, 2022
    Trending Now

    Belkin’s MagSafe charging stand can now fast charge the Apple Watch Series 7

    By techbizweb

    Ghislaine Maxwell sentenced to 20 years for aiding Jeffrey Epstein’s abuse

    By techbizweb

    Android 13’s Easter egg is a delightful kaleidoscope of emoji

    By techbizweb

    https://www.nationalsportsacademy.com

    slot gacor hari ini

    http://www.inadesfo.org/

    http://www.eueomgbissau.org/

    http://www.congo-mai-mai.net/

    http://www.angelesdelafrontera.org/

    http://fifaworldcup2018schedule.com/

    http://tony4gtrmcr.co.uk/

    http://www.standrewsagreement.org/

    http://www.bob-russell.co.uk/

    http://davidmulholland.co.uk/

    http://railwayhotelenniskillen.com/

    http://www.fantasysportstrades.com/

    http://www.rainleaf-flooring.com

    http://mothersagainstguns.org/

    http://ma-coc.org/

    slot online

    http://www.paradoxmag.com/situs-judi-slot-online-gampang-menang-2021/

    http://www.paradoxmag.com/situs-judi-slot-online-terbaru-2021/

    http://slot-terbaru.net/

    Slot Gacor

    Slot Online

    Situs Slot Gacor

    http://www.appdexterity.com/

    https://cars4kids-deutschland.de/

    https://www.stretchingculture.com/

    https://www.b-123-hp.com/slot-gacor/

    https://denzstaffing.nl/

    https://ezbbqcooking.com/slot-gacor/

    https://www.mbahelp24.com/slot-gacor

    https://minhtanstore.com/slot-jackpot-terbesar/

    https://njbpusupplierdiversity.com/slot-gacor-gampang-menang/

    https://www.floridaspecialtycropfoundation.org/slot-gampang-menang/

    https://childrenscornerpreschool.org/slot-gacor-gampang-menang/

    https://cryptoquoter.com/slot-online-terbaik/

    https://alorkantho24.com/slot-gacor/

    https://ellas.xyz/slot-gacor/

    https://it.dougamatome.xyz/slot-online/

    https://www.daltercume.com/slot-gacor/

    https://josi-ana.dougamatome.xyz/slot88/

    https://josi-ana.dougamatome.xyz/slot-gacor/

    https://fastobserver.com/slot-jackpot-terbesar/

    https://www.planetexperts.com/slot-gacor/

    https://bfsolution.group/slot-bet-kecil/

    https://rustleva.co/slot/

    https://bfsolution.group/slot-bet-kecil/

    https://www.hotelcalimareal.com/togel-online/

    https://anime-game.dougamatome.xyz/slot-gacor-gampang-menang/

    https://anime-game.dougamatome.xyz/togel-online/

    https://bourbonbarrelfoods.com/slot/

    http://suneo39.wp.xdomain.jp/slot/

    https://techbizweb.com/slot-gacor/

    https://www.generalcatalyst.com/18-daftar-slot-gacor-terbaik-gampang-menang-jackpot-hari-ini/

    https://www.hotelcalimareal.com/slot-online/

    https://www.blockgates.io/slot-gacor/

    https://l12.com.br/slot-gacor/

    slot paling gacor

    https://www.donalds-hobby.com/slot-online/

    https://thecryptodirt.com/slot-gacor-hari-ini/

    http://iseta.edu.ar/aulavirtual/app/upload/users/1/1205/my_files/sbobet.html

    http://escuelavirtual.mincit.gov.co/app/upload/users/1/194/my_files/slot.html

    https://www.dev.medecinesfax.org/courses/JUDICASINO/document/slot.html

    http://www.e-archivos.org/cursos/courses/JUDICASINO/document/slot-gacor.html

    http://iesma.com.br/ead/main/upload/users/4/447/my_files/slot.html

    https://www.fundacoop.org/chamilo/app/upload/users/1/1185/my_files/slot.html

    https://fata-aatf.org/eskola/main/upload/users/3/31/my_files/slot.html

    https://uancv.edu.pe/ofinvestigacion/app/upload/users/3/328/my_files/slot-terlengkap.html

    https://micost.edu.my/EL/app/upload/users/2/209/my_files/slot-gacor.html

    https://www.academiacoderdojo.ro/elearningdev/app/upload/users/2/2442/my_files/slot-online.html

    http://campus-cidci.ulg.ac.be/courses/JUDICASINO/document/slot-termurah.html

    https://www.escueladerobotica.misiones.gob.ar/aula-ste/courses/LIVECASINO/document/slot-tergacor.html

    http://ccdipeepccqqfar.usac.edu.gt/chamilo/app/upload/users/3/358/my_files/slot-online.html

    https://cunori.edu.gt/campus/app/upload/users/7/7334/my_files/slot-online.html

    http://u-rus.com.ar/aula/app/upload/users/1/1322/my_files/slot.html

    http://icrodarisoveria.edu.it/chamilo/app/upload/users/1/1855/my_files/slot.html

    https://iestpliliagutierrez.edu.pe/clarolgm/courses/CASINO/document/slot.html

    http://pva.cobach.edu.mx/app/upload/users/7/7379/my_files/slot.html

    http://www.imb-pc-online.edu.gt/PL/app/upload/users/3/373/my_files/slot.html

    http://avcs.upeu.edu.pe/main/upload/users/3333/my_files/slot.html

    https://chamilo.fca.uas.edu.mx/app/upload/users/1/11186/my_files/slot-online/

    TechBizWeb
    Facebook Twitter Instagram Pinterest Vimeo YouTube
    • Home
    • Guest Post
    • About Us
    • Privacy Policy
    • Our Authors
    • Terms and Conditions
    • Contact
    © 2022 Tech Biz Web. Developed by Sawah Dev.

    Type above and press Enter to search. Press Esc to cancel.