Neurevt Trojan Targets Mexican Financial Users With Credential-Stealing Backdoor
Summary
Talos analyzed a Neurevt variant targeting Mexican financial users. Delivered through obfuscated PowerShell, it establishes persistence, evades defenses, captures keystrokes and screen data, and exfiltrates information to command-and-control servers.
Key points
- The malware begins with an obfuscated PowerShell command that downloads the first-stage executable from saltoune[.]xyz.
- Neurevt establishes persistence through Windows registry changes, injects processes, and attempts privilege escalation by accessing service-token information.
- It disables the Windows firewall, alters internet security and proxy settings, removes Mark-of-the-Web data, and checks for virtualized or debugger environments.
- The trojan captures keystrokes, mouse activity, screenshots, clipboard contents, and system information; it can interact with Mexican banking websites to steal credentials and 2FA tokens.
- It sends collected data in HTTP POST requests to command-and-control domains, including russk18[.]icu and moscow13[.]at.
- Talos released ClamAV signatures and Snort SID 57989; the article recommends patching systems, restricting suspicious downloads and scripts, and blocking malicious infrastructure.
Article Details
- Attack Vectors
- An obfuscated PowerShell command downloads the first-stage Neurevt executable from saltoune[.]xyz.
- The malware drops scripts and executables, uses registry entries for persistence, and launches additional stages through WScript.exe and batch files.
- The malware injects an executable image into a child process and uses process injection in explorer.exe.
- Neurevt hooks keyboard and mouse input, captures screenshots and clipboard data, and targets credentials and 2FA tokens associated with Mexican banking websites.
- The malware disables the Windows firewall, modifies Internet and proxy settings, removes mark-of-the-web metadata, and checks for virtualization and debugging environments.
- The malware communicates with C2 infrastructure and exfiltrates information in HTTP POST requests.
- Defensive Notes
- Talos recommends keeping operating systems and applications updated, restricting access to suspicious websites and downloads, and enabling multi-factor authentication.
- Organizations are advised to use role-based access control for Windows administrative tools, enforce PowerShell execution policy, and block suspicious IP addresses, domains, and C2 traffic.
- The article recommends disabling automatic browser-script execution and using updated antivirus scan engines.
- Cisco Secure Endpoint, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, and Snort coverage are described as available detections or protections.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | morningstarlincoln[.]co[.]uk | Malware download infrastructure serving a PE file. |
| DOMAIN | moscow11[.]at | Domain listed in the article's IOC section as Neurevt threat infrastructure. |
| DOMAIN | moscow13[.]at | C2 domain identified for HTTP POST exfiltration. |
| DOMAIN | russk17[.]icu | Malware download domain serving the seer.exe executable. |
| DOMAIN | russk18[.]icu | C2 domain receiving HTTP POST data from compromised machines. |
| DOMAIN | russk19[.]icu | Domain listed in the article's IOC section as Neurevt threat infrastructure. |
| DOMAIN | russk20[.]icu | Domain listed in the article's IOC section as Neurevt threat infrastructure. |
| DOMAIN | russk21[.]icu | Domain listed in the article's IOC section as Neurevt threat infrastructure. |
| DOMAIN | russk22[.]icu | Domain listed in the article's IOC section as Neurevt threat infrastructure. |
| DOMAIN | saltoune[.]xyz | Malicious download domain serving the first-stage Neurevt executable. |
| IPV4 | 162[.]213[.]251[.]176 | IP address serving the malicious saltoune[.]xyz domain. |
| IPV4 | 23[.]95[.]225[.]105 | IP address associated with the russk17[.]icu malware download host. |
| IPV4 | 79[.]170[.]44[.]146 | IP address associated with the malware download host morningstarlincoln[.]co[.]uk. |
| SHA256 | 35617cfc3e8cf02b91d59209fc1cd07c9c1bc4d639309d9ab0198cd60af05d29 | Hash of a malicious PE file downloaded from the reported malware infrastructure. |
| SHA256 | 4d3ee3c1f78754eb21b3b561873fab320b89df650bbb6a69e288175ec286a68f | Hash of the seer.exe executable downloaded from russk17[.]icu. |
| SHA256 | 5624eea08b241314b8bd13ee9429449c53085a6bb2bcc481655f1f28b4314122 | Hash reported in the technical analysis for the Neurevt executable named 13q77qiq.exe. |
| SHA256 | 86aab09b278fe8e538d8cecd28f2d7a32fe413724d5ee52e2815a3267a988595 | Hash of the malicious first-stage Win32 executable hosted on saltoune[.]xyz. |
| URL | hxxp[:]//morningstarlincoln[.]co[.]uk/site/bmw/studi.exe | Specific URL listed for a malware payload download. |
| URL | hxxp[:]//russk17[.]icu/mailo/seer.exe | Specific URL listed for the seer.exe malware download. |
| URL | hxxp[:]//saltoune[.]xyz/pb/aa.exe | Specific URL listed as a first-stage malware download. |
| URL | hxxps[:]//saltoune[.]xyz/pb/aa.exe | Specific URL used to download the first-stage malware. |
MITRE ATT&CK
T1012 · Query RegistryThe malware accesses registry information as part of its reported discovery behavior.T1055 · Process InjectionThe malware writes an executable image into child-process virtual memory and injects an image into explorer.exe.T1056 · Input CaptureNeurevt installs hooks to monitor keystrokes and mouse input and captures credentials and 2FA tokens.T1057 · Process DiscoveryThe article identifies process discovery among the malware's reported discovery techniques.T1082 · System Information DiscoveryThe malware retrieves operating-system version information.T1083 · File and Directory DiscoveryNeurevt enumerates files, directories, and disk-drive information on the victim's system.T1112 · Modify RegistryThe malware modifies registry settings, including storing binary data in a registry key.T1120 · Peripheral Device DiscoveryThe malware retrieves keyboard layout information and enumerates peripheral-related system information.T1497 · Virtualization/Sandbox EvasionThe malware checks for VirtualBox and VMware artifacts and uses debugger-detection APIs.T1518 · Software DiscoveryNeurevt detects the Java Runtime Environment version.T1546 · Event Triggered ExecutionThe article reports Image File Execution Options debugger values used to run malicious code when another application starts.T1547 · Boot or Logon Autostart ExecutionNeurevt adds its executable path to Windows Run and RunOnce registry keys for persistence.T1553 · Subvert Trust ControlsThe malware checks for and deletes Zone Identifier metadata from downloaded files.T1562 · Impair DefensesNeurevt disables the Windows firewall and weakens Internet Explorer security settings.
People
Malware
Vendors
Products
Cisco Secure EndpointCisco Talos discovered a new version of the Neurevt trojan with spyware and backdoor capabilities in June 2021 using Cisco Secure Endpoint product telemetry.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such asThreat Defense Virtual,Adaptive Security Appliance andMeraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (formerly Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco UmbrellaCisco Secure Endpoint, SNORTⓇ and Cisco Umbrella can all protect users from downloading this malware, protecting their online banking accounts from potential theft.Google Chromeattempts to bypass the PowerShell execution policy of the compromised endpoint and creates a new Google Chrome web client object to connect to a domain saltoune[.]xyz and download an executable file, which is theInternet ExplorerRegistry keys to set internet explorer ZoneMap.Microsoft WindowsWScript.exe process reads the file "C:\LMPupdate\set\435246.vbs"and launches Windows shell and runs the batch file "C:\LMPupdate\set\183.bat".SnortCisco Secure Endpoint, SNORTⓇ and Cisco Umbrella can all protect users from downloading this malware, protecting their online banking accounts from potential theft.