Today My Online Security published research describing a fairly large Ursnif campaign targeting the United Kingdom. The threat actors behind the attack are using Brexit as a topical lure to attract potential phishing candidates, with emails mentioning Brexit in the subject line linking to a google document that downloads the malware file.
On Twitter a user by the name of craT0x (@justmlwhunting) published the payload of this malware sample. We took the payload from the researcher’s tweet and performed an analysis on our Genetic Malware Analysis tool, Intezer Analyze, to see if we could confirm that the payload shares code with previously seen Ursnif samples.
Thank you for sharing!
This is the payload:https://t.co/OzXJATVzfy#ursnif
— craT0x (@justmlwhunting) December 11, 2018
Intezer Analyze detected the payload as malicious and classified it as a member of the Ursnif malware family. As you can see below, the payload shares 22 genes and 12 strings with previous Ursnif samples.
https://analyze.intezer.com/#/analyses/d2f9c2bb-9106-462c-8f60-9923b7870f38
Identifying patterns in code reuse is an effective way to accurately detect and classify malware. Try Intezer Analyze today. Users of the free community edition can upload up to 10 files per day to identify both trusted and malicious software and classify malicious files to their respective malware families.
About us:
Intezer introduces a Genetic Malware Analysis approach, offering enterprises unparalleled and accelerated incident response.
Intezer provides a fast, in-depth understanding of any file by mapping its code DNA at the ‘gene’ level — offering the most advanced level of malware analysis. By identifying the origins of every piece of code, Intezer is able to detect code reuse from known malware, as well as code that was seen in trusted applications. For more information, visit https://www.intezer.com/ or follow us on Twitter at @IntezerLabs.
The post Verifying Code Reuse Between Ursnif and ‘Brexit’ Malware Campaign Targeting the United Kingdom appeared first on Intezer.
Article Link: https://www.intezer.com/blog-ursnif-malware/