March 2020’s Most Wanted Malware: Dridex Banking Trojan Ranks On Top Malware List For First Time

Check Point’s researchers find Dridex has been updated and spread via multiple spam campaigns to deliver targeted ransomware, increasing the risk from the long-established trojan

Our latest Global Threat Index for March 2020 shows the well-known banking trojan Dridex, which first appeared in 2011, has entered the top ten malware list for the first time, as the third most prevalent malware in March. Dridex has been updated and is now being used in the early attack stages for downloading targeted ransomware, such as BitPaymer and DoppelPaymer.

The sharp increase in the use of Dridex was driven by several spam campaigns containing a malicious Excel file which downloads Dridex malware into the victim’s computer.  This upsurge in Dridex malware highlights just how quickly cyber-criminals change the themes of their attacks to try and maximize infection rates.

Dridex is a sophisticated strain of banking malware that targets the Windows platform, delivering spam campaigns to infect computers and steal banking credentials and other personal information to facilitate fraudulent money transfer.  The malware has been systematically updated and developed over the past decade. XMRig remains in 1st place in the Index of top malware families, impacting 5% of organizations globally, followed by Jsecoin and Dridex which impacted 4% and 3% of organizations worldwide respectively.

Dridex can be very lucrative for criminals given its sophistication, and is now being used as a ransomware downloader, which makes it even more dangerous than previous variants.  Individuals need to be wary of emails with attachments, even if they appear to originate from a trusted source – especially with the explosion in home working over the past few weeks. Organizations need to be educating employees on how to identify malicious spam, and deploy security measures that help protect their teams and networks against such threats.

The March report also warns that “MVPower DVR Remote Code Execution” remained the most common exploited vulnerability, impacting 30% of organizations globally, closely followed by “PHP php-cgi Query String Parameter Code Execution” with a global impact of 29%, followed by “OpenSSL TLS DTLS Heartbeat Information Disclosure” impacting 27% of organizations worldwide.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

This month XMRig remains in 1st place, impacting 5% of organizations globally, followed by Jsecoin and Dridex impacting 4% and 3% of organizations worldwide respectively.

1. ↔ XMRig – XMRig is an open-source CPU mining software used for the mining process of the Monero cryptocurrency, first seen in the wild on May 2017.

2. ↑Jsecoin – Jsecoin is a web-based cryptominer, designed to perform online mining of Monero cryptocurrency when a user visits a particular web page. The implanted JavaScript uses a large amount of the end user’s computational resources to mine coins, thus impacting the system performance.

5. ↑ Dridex – Dridex is a Banking Trojan that targets the Windows platform, and is delivered by spam campaigns and exploit kits, which rely on WebInjects to intercept and redirect banking credentials to an attacker-controlled server. Dridex contacts a remote server, sends information about the infected system and can also download and execute additional modules for remote control.
6. ↔ Trickbot – Trickbot is a dominant banking Trojan constantly being updated with new capabilities, features and distribution vectors. This enables Trickbot to be a flexible and customizable malware that can be distributed as part of multi-purposed campaigns.
7. ↓ Emotet – Emotet is an advanced, self-propagate and modular Trojan. Emotet was once employed as a banking Trojan, and recently is used as a distributer to other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malware.
8. ↔ Agent Tesla – Agent Tesla is an advanced RAT, functioning as a keylogger and a password stealer. Agent Tesla is capable of monitoring and collecting the victim’s keyboard input, system clipboard, taking screenshots, and exfiltrating
   credentials from a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and Microsoft Outlook email client).
9. ↑ Formbook – Formbook is an Info Stealer that harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to its C&C orders.
10. ↓ Lokibot – Lokibot is an Info Stealer distributed mainly by phishing emails and is used to steal various data such as email credentials, as well as passwords to CryptoCoin wallets and FTP servers.
11. ↓ Ramnit – Ramnit is banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.
12. ↑ RigEK– RigEK delivers exploits for Flash, Java, Silverlight and Internet Explorer. The infection chain starts with a redirection to a landing page that contains JavaScript that checks for vulnerable plug-ins and delivers the exploit.

Top exploited vulnerabilities

This month the “MVPower DVR Remote Code Execution” remains the most common exploited vulnerability, impacting 30% of organizations globally, closely followed by “PHP php-cgi Query String Parameter Code Execution” with a global impact of 29%.  In 3rd place “OpenSSL TLS DTLS Heartbeat Information Disclosure” is impacting 27% of organizations worldwide.

1. ↔ MVPower DVR Remote Code Execution – A remote code execution vulnerability that exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
2. ↑ PHP php-cgi Query String Parameter Code Execution – A remote code execution vulnerability that has been reported in PHP. The vulnerability is due to the improper parsing and filtering of query strings by PHP. A remote attacker may exploit this issue by sending crafted HTTP requests. Successful exploitation allows an attacker to execute arbitrary code on the target.
3. ↓ OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346) – An information disclosure vulnerability which exists in OpenSSL. The vulnerability is due to an error when handling TLS/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose memory contents of a connected client or server.
4. ↑ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
5. ↓ Dasan GPON Router Authentication Bypass (CVE-2018-10561) – An authentication bypass vulnerability exists in Dasan GPON routers. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system.
6. ↑Huawei HG532 Router Remote Code Execution – A remote code execution vulnerability exists in Huawei HG532 Routers. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
7. ↑ D-Link DSL-2750B Remote Command Execution – An authentication bypass vulnerability exists in WordPress portable-phpMyAdmin Plugin. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system.
8. ↓PHP DIESCAN information disclosure – An information disclosure vulnerability that has been reported in the PHP pages. Successful exploitation could lead to the disclosure of sensitive information from the server.
9. ↓SQL Injection (several techniques) – Inserting an injection of SQL query in input from client to application, while exploiting a security vulnerability in an application’s software.
10. ↑ OpenSSL Padding Oracle Information Disclosure – An information disclosure vulnerability exists in the AES-NI implementation of OpenSSL. The vulnerability is due to memory allocation miscalculation during a certain padding check. A remote attacker can exploit this vulnerability to obtain sensitive clear text information via a padding-oracle attack against an AES CBC session.

Top malware families – Mobile

This month xHelper retained the 1^st place in the most prevalent mobile malware, followed by AndroidBauts and Lotoor.

1. xHelper – A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application can hide itself from the user and reinstall itself in case if uninstalled.
2. AndroidBauts – Adware targeting Android users that exfiltrates IMEI, IMSI, GPS location and other device information and allows the installation of third-party apps and shortcuts on mobile devices.

3. Lotoor – A hacking tool that exploits vulnerabilities on Android operating systems to gain root privileges on compromised mobile devices.