Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1075283" data-attributes="member: 32260">WHHLight vs. Coyote Trojan(Smart App Control set to OFF)[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/new-coyote-trojan-targets-61-brazilian-banks-with-nim-powered-attack.128971/post-1075167[/URL][URL unfurl=&quot;true&quot;]https://securelist.com/coyote-multi-stage-banking-trojan/111846/[/URL]Attack flow:[ATTACH=full]281542[/ATTACH]The new aspects of the attack start after malicious DLL side-loading. The hashes of DLLs used in the attacks are included in the Securelist article. But, the initial malware (malicious Squirrel Installer) is skipped. Anyway, I found a few initial malware files on the VitusTotal:9c6fc9e0854eaf5a0720caab1646f48c7992f6f4051438004598af89102a49eb096d7765f278bb0de33fbfa0a15413a2432060d09c99f15c6ca900a6a8a46365aedffb9cf780bb52c68586ceb238fcaf90253524f06a4a338edc6437409e51c53cbc282c6a51edff4e762267332e1ff2a503f7ba8a7b2a10c9ff404a7bda913bAll samples are unsigned and can be blocked by SmartScreen and WDAC ISG ( &lt; WDAC &gt; option must be set to ON).</blockquote>

[QUOTE="Andy Ful, post: 1075283, member: 32260"] [B][SIZE=5]WHHLight vs. Coyote Trojan[/SIZE] (Smart App Control set to OFF)[/B] [URL unfurl="true"]https://malwaretips.com/threads/new-coyote-trojan-targets-61-brazilian-banks-with-nim-powered-attack.128971/post-1075167[/URL] [URL unfurl="true"]https://securelist.com/coyote-multi-stage-banking-trojan/111846/[/URL] [B][COLOR=rgb(184, 49, 47)]Attack flow:[/COLOR][/B] [ATTACH type="full" width="420px" alt="1707831860301.png"]281542[/ATTACH] The new aspects of the attack start after malicious DLL side-loading. The hashes of DLLs used in the attacks are included in the Securelist article. But, the initial malware (malicious Squirrel Installer) is skipped. Anyway, I found a few initial malware files on the VitusTotal: 9c6fc9e0854eaf5a0720caab1646f48c7992f6f4051438004598af89102a49eb 096d7765f278bb0de33fbfa0a15413a2432060d09c99f15c6ca900a6a8a46365 aedffb9cf780bb52c68586ceb238fcaf90253524f06a4a338edc6437409e51c5 3cbc282c6a51edff4e762267332e1ff2a503f7ba8a7b2a10c9ff404a7bda913b [B]All samples are unsigned and can be blocked by SmartScreen and WDAC ISG ( < WDAC > option must be set to ON).[/B] [/QUOTE]

Verification