Hackers Using Stolen Bank Information to Trick Victims into Downloading BitRAT Malware

Jan 03, 2023Ravie LakshmananUnited States

A new malware campaign has been observed using sensitive
information stolen from a bank as a lure in phishing emails to drop
a remote access trojan called BitRAT.

The unknown adversary is believed to have hijacked the IT
infrastructure of a Colombian cooperative bank, using the
information to craft convincing decoy messages to lure victims into
opening suspicious Excel attachments.

The discovery comes from cybersecurity firm Qualys, which
found^[1]
evidence of a database dump comprising 418,777 records that’s said
to have been obtained by exploiting SQL injection faults.

The leaked details include Cédula numbers (a national identity
document issued to Colombian citizens), email addresses, phone
numbers, customer names, payment records, salary details, and
addresses, among others.

There are no signs that the information has been previously
shared on any forums in the darknet or clear web, suggesting that
the threat actors themselves got access to customer data to mount
the phishing attacks.

The Excel file, which contains the exfiltrated bank data, also
embeds within it a macro that’s used to download a second-stage DLL
payload, which is configured to retrieve and execute BitRAT on the
compromised host.

“It uses the WinHTTP library to download BitRAT embedded
payloads from GitHub to the %temp% directory,” Qualys researcher
Akshat Pradhan said.

Created in mid-November 2022, the GitHub repository is used to
host obfuscated BitRAT loader samples that are ultimately decoded
and launched to complete the infection chains.

BitRAT^[2], an off-the-shelf
malware available on sale on underground forums for a mere $20,
comes with a wide range of functionalities^[3] to steal data, harvest
credentials, mine cryptocurrency, and download additional
binaries.

“Commercial off the shelf RATs have been evolving their
methodology to spread and infect their victims,” Pradhan said.
“They have also increased the usage of legitimate infrastructures
to host their payloads and defenders need to account for it.”