Kronos Trojan hits the Banking Sector back with a new version

Kronos banking Trojan was first discovered in 2014. The malware capable of stealing banking credentials had its heydays back then. However, in 2016, suddenly the once daunting banking Trojan laid dormant and dropped off researchers’ hit list.
Recent research reveals that the malware is back again with its revamped version. The Trojan did made to the headlines in 2017 but the attack samples appeared to be mild with limited activity.
On 27^th June 2018, the new variant got off the ground and is known to have launched four distinct campaigns since then targeting Germany, Japan and Poland and also one test campaign.
The new Version of the Kronos Banking Trojan has been retooled with a few new incorporated features like a new command-and-control feature that is designed to work with an anonymizing network – Tor. Tor is free software that enables anonymous communication. The software is intended to conceal Internet activity of the user to protect their privacy, giving them space to conduct confidential communication without letting their activities being monitored.
Many features of this new Kronos banking Trojan however remain the same. For instance,

• There is extensive overlap in the code of 2014 and 2018 variants.
• Windows API hashing technique and hashes of the new and the old version remain the same
• Extensive string overlap
• String encryption technique is again same
• Same C&C (Command and Control) protocol and encryption
• Same C&C encryption mechanism
• Same Webinject format (Zeus format)
• Similar C&C panel file layout

Also, it is believed that the new variant of the banking Trojan besides being retooled, has been rebranded as Osiris. This new Osiris malware used by some criminals has similar characteristics as that of Kronos banking Trojan. For instance, this Osiris Trojan is claimed to be 350 KB in size which is the alm

ost the same as Kronos’s size which is 351 KB.  Also the name is apt as Orisis is the Egyptian God of rebirth.

Campaign Analysis

• Campaign against Germany: June 27-30 2018

A spam email campaign was discovered on June 27 2018 that targeted German users. The victims were customers of financial institutions and were purportedly send a spam mail with malicious attachments. The subject of the email when translated in English read as:

1. Updating our terms and conditions
2. Reminder: 94151……

The attached word documents contained macros that prompted users to enable it. Macros by default are disabled by Microsoft. Once it was enabled, the malicious script contained in the doc executed a new variant of Kronos Trojan. In these infringements, the Trojan used the URL http://jhrppbnh4d674kzh[.]onion/kpanel as its C&C. It downloaded web injects to steal credentials and other personal institutions through a web browser targeting five German financial institutions. The new variant is also known to have used an intermediate smoke-loader – a small application used to download other malware in the victimized system.
Read Full News