Article Summary
In May 2019, enSilo’s Threat Intelligence team observed activity by a cybercrime group, spreading Metamorfo - A Brazilian banking trojan. The variants we discovered abuse an executable digitally signed by Avast, which is one of the most popular AV products in the world for consumers. We were able to connect this activity to a campaign reported by TrendMicro which targeted an executable by a different Anti-Virus vendor, Avira. This further highlights the Modus-Operandi of the group.
This blog post describes in detail one of the variants used in this campaign and highlights unique Tactics, Techniques and Procedures (TTPs) used in this campaign which were not previously disclosed.
Article Link: https://blog.ensilo.com/metamorfo-avast-abuser