Researchers at Fortinet identified in August a targeted campaign of the banking trojan Casbaneiro aimed at customers of financial institutions in Argentina, Peru, Colombia, and Mexico.
The attack is notable for remaining inactive until the victim visits a monitored bank website. Infection starts with an email containing a PDF that creates urgency around an unpaid invoice or alleged judicial procedure. The document displays the recipient’s own email address to increase perceived legitimacy.
The embedded link performs IP-address verification. Visitors from outside the four targeted countries are redirected to Google or YouTube, while intended victims silently receive a Base64-encoded ZIP archive.
Inside the archive is an HTA file that downloads three components: the legitimate AutoIt interpreter, a compiled script, and a separately compressed payload. Using a legitimate interpreter helps bypass defenses that examine only the initial binary.
Once installed, Casbaneiro does not immediately contact its command-and-control servers. It waits until the victim accesses one of the selected banking sites, then transmits system information. This timing reduces the window during which malicious traffic is visible.
Thereafter the malware harvests Outlook address-book entries and sender/recipient data. It can also display fake windows tailored to specific banks in order to capture credentials. The remote-access module accepts commands to control the keyboard, paste clipboard contents, execute files, and run arbitrary system commands, granting operators direct control of the infected device.
