Emerging Matrix Banker Trojan is targeting banks in Latin America

Security Experts at Arbor Networks have spotted a new banking trojan, initially called ‘Matrix Banker’, that is targeting Latin America.

Malware researchers at Arbor Networks have spotted a new banking trojan, initially called ‘Matrix Banker’, that is targeting Latin America.

The malicious code seems to be still under development, most of the victims were located in Mexico and Perù.

“Initially, we’ve called it “Matrix Banker” based on its command and control (C2) login panel, but it seems that “Matrix Admin” is a template available for the Bootstrap web framework. Proofpoint calls it “Win32/RediModiUpd” based on a debugging string from an earlier sample.” states Arbor Networks.

The initial loader for Matrix Banker Trojan gains persistence through Registry Run, it extracts and injects a DLL into most popular Internet Browser, including Chrome, Firefox, Internet Explorer or Edge.

The main DLL is injected in a browser to hook browser functions and run a Man-In-the-Browser attack.

“Once the main DLL is injected in a browser, it starts by hooking the appropriate browser functions (e.g. PR_Read and PR_Write for Firefox) to setup a “man-in-the-browser” (MitB).” states the report. “It then phones home to its C2 server to get the webinject config. The request looks like this:”

The malware then contacts the C&C server to get the webinject config.

Matrix Banker is the first malware that encodes the and encrypts response from the C&C server with the Salsa20 crypto algorithm.

Salsa20 is an unpatented stream cipher developed by Daniel Bernstein, it is the same algorithm used by the Petya ransomware to encrypt victims’ Master File Table.

“While functional, the webinject format looks to be under construction.” state the report. “Earlier samples use a different, simpler format and there is plenty of work to do to catch up with the industry standard Zeus webinjects.”

Experts noticed the malware uses a very difficult and effective redirection to a phishing page that looks like a perfect copy of the targeted bank’s login page.”

Researchers believe it is not possible in this phase to predict the impact of the malware on a large-scale, the unique certainty is that the threat is actively being developed and targeting financial institutions in the wild.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Matrix Banker, malware)

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.