Horabot Banking Trojan Resurfaces in Mexico With Multi-Stage Phishing and Email Worm Tactics
The Horabot banking trojan has re-emerged in Mexico, employing a multi-stage infection process and an email worm to turn compromised machines into phishing relays. This threat integrates a Delphi-based banking trojan with a PowerShell-driven spreader,…
The Horabot banking trojan has re-emerged in Mexico, employing a multi-stage infection process and an email worm to turn compromised machines into phishing relays. This threat integrates a Delphi-based banking trojan with a PowerShell-driven spreader, making it a significant financially motivated threat in Latin America.
The attack initiates with a fake CAPTCHA page prompting users to execute a malicious command via the Windows Run dialog. This method does not exploit software vulnerabilities but instead relies on user manipulation to execute a harmful HTA file, thereby bypassing many endpoint defenses.
Following the execution of the HTA file, a JavaScript loader is fetched from a controlled domain, leading to the execution of an obfuscated VBScript. This script uses server-side polymorphism to evade detection, while another VBScript collects system information and communicates with a command-and-control server. AutoIT components are used for persistence, and an AES-192-encrypted blob is decrypted to load the banking trojan.
Researchers have identified 5,384 infected devices, with 93% located in Mexico. The campaign displays connections to Brazil, as evidenced by Brazilian Portuguese comments in the PowerShell code and references in the encryption key. Phishing emails, crafted as fake invoices or confidential documents, are written in Spanish and target Mexican recipients.
The attack initiates with a fake CAPTCHA page prompting users to execute a malicious command via the Windows Run dialog.
The Delphi banking trojan, also known as Casbaneiro, Ponteiro, and Metamorfo, employs fake bank overlay pop-ups to capture login credentials during banking sessions. The email worm spreads by harvesting contact addresses and sending phishing emails with malicious PDFs to initiate the infection cycle.
Block execution of HTA files from untrusted sources and monitor for suspicious mshta activity. Utilize YARA rules for detecting the Horabot Delphi trojan and AutoIT loader, alongside Suricata rules targeting the C2 traffic pattern. Add known indicators of compromise to network blocklists promptly. Implement user awareness training focused on recognizing fake CAPTCHA lures and malicious PDF attachments.
For additional information, see the full analysis .
Based on reporting by Cyber Security News.