Skip to content

ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic

BRATISLAVA, PRAGUE – As part of an ongoing series on Latin American banking trojans, ESET researchers take an in-depth look at Grandoreiro. This trojan targets users especially in Brazil, Mexico, Spain and Peru. Distributed almost exclusively through email spam, it has lately started to utilize fake websites capitalizing on the global coronavirus pandemic. Grandoreiro reveals a persistent effort from its authors to evade detection. Although ESET has seen Grandoreiro primarily distributed through spam, where the authors usually utilize a fake Java or Flash update, recently we have observed a shift to COVID19 related scams. The trojan was hiding in videos on fake websites promising information about the coronavirus. However, instead of playing, clicking the video leads to the download of a payload on visitors’ devices.Grandoreiro has been active since at least 2017 in Brazil and Peru, expanding to Mexico and Spain in 2019. As with other Latin American banking trojans in this series, Grandoreiro attacks its victims by displaying fake pop-up windows as a ploy to get them to divulge sensitive information.

The backdoor functionality of Grandoreiro includes manipulating windows; updating itself; capturing keystrokes; simulating mouse and keyboard actions; navigating browsers to chosen URLs; signing out and restarting machines; and blocking access to websites. Grandoreiro collects various information about affected machines and, in some versions, it also steals credentials stored in Google Chrome as well as data stored in Microsoft Outlook browsers.“For a Latin American banking trojan, Grandoreiro utilizes a surprisingly large number of tricks to evade detection and emulation. That includes many techniques to detect or even disable banking protection software,” says ESET researcher Robert Šuman, leading the team analyzing Grandoreiro. “They seem to be developing the banking trojan very rapidly. Almost every new version we see introduces some changes. We also suspect they are developing at least two variants simultaneously. Interestingly, from a technical point of view, they also utilize a very specific application of the binary padding technique that makes it hard to get rid of the padding while keeping a valid file,” adds Šuman.Unlike the majority of Latin American banking trojans, Grandoreiro utilizes quite small distribution chains. For different campaigns, it may choose a different type of downloader. These downloaders are often stored on well-known public online sharing services such as GitHub, Dropbox, Pastebin, 4shared or 4Sync.

For more technical details about Grandoreiro, read the blogpost “Grandoreiro: How engorged can an EXE get?” on WeLiveSecurity.com. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

GREYCORTEX CTO ON SECURING THE HOME-OFFICE NETWORK

The emergency provisions related to COVID-19 have been active for some time and more and more companies are allowing their employees to work from home. We asked Our Chief Technology Officer Vladimír Sedláček, a seasoned administrator of ICT, corporate systems, cybersecurity, and experienced developer, about his opinion on current affairs.

The Coronavirus pandemic impact is discussed everywhere, but few people seem to realize that despite all the physical risks, digital issues still present a significant problem. How do you see the current situation, and what do you consider to be the biggest risk in terms of virtual infections, and their possible outcome for companies?

It would be naive to assume that the global crisis would lead to a drop in cyberattacks or will result in a ceasefire. On the contrary. In nature, each weakened individual becomes prey. Regardless of any previous “ceasefire declarations”, we see an increase in the number of attacks and targeted at the SARS-NCov-2 situation. Obviously, we can expect contacts from faux health inspectors and money collectors. Even my inbox has received several phishing emails offering nano-silver infused masks. In addition to attacking the weakest part of cybersecurity – the user – we also see an increase in scanning; looking for vulnerable computers and security holes in firewalls or hastily constructed VPNs and remote desktop gateways. In the end, all of this contributes to latent disclosure of company secrets, production, and patent documentation, or personal data. Infiltration by extortion malware also becomes a threat and can mean a total production halt, as seen both last year and recently in some hospitals in the Czech Republic.

What do you see as the most common errors from employers and top management regarding data exposure; and how does the risk increase with massive deployments of quarantine provisions where most employees work from home?

Right now, the risk is increased by companies laying off contractors, often those working on infrastructure, promoting rotating furloughs, and allowing their administrators to work from home. This can cause a delay in necessary security patching and increased response time. Also, ad hoc suspension of certain user accounts can leave the access ripe for unauthorized access restores later. Last, but not least, some companies have allowed their employees to work from home using their home computers. VPN has thus become a gateway for free access directly into company networks, and to internal company systems, all thanks to home devices with uncertain security postures, possibly outdated operating systems, obsolete software, or a load of games full of spyware. These systems are being used by home-bound users surfing the web with local superuser rights. It is very similar to allowing the usage of personal devices (BYOD) and letting them directly connect into internal, as opposed to guest networks. A lot of companies do not, however, tackle the situation accordingly, and have not familiarized their employees with relevant security policies. Without in-depth employee training and without respecting the basic rules of cyber hygiene, internal data can leave the control of responsible people working with it. What has not received much attention so far is the risk of company device theft in conjunction with wiping such devices clean. Partly due to the fact that the employees “stay home” and are convinced that they have good visibility over their physical environment. However, thefts will happen, and the security angle will need to be tackled. I cannot understand why so few administrators allow internal networks to stay open, and who pay attention to their internal network traffic with only commonly used tools for network monitoring. Same tools that are deployed normally are themselves a potential attack target.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

ESET researchers disrupt cryptomining botnet VictoryGate

BRATISLAVA, BUENOS AIRES – ESET researchers have recently discovered a previously undocumented botnet named VictoryGate. It has been active since at least May 2019, and is composed mainly of devices in Peru, where over 90% of the infected devices are located. The main activity of the botnet is mining Monero cryptocurrency. The victims include organizations in both public and private sectors, including financial institutions. Thanks to data obtained during this research and shared with the nonprofit Shadowserver Foundation, at least a portion of the botnet operation has been disrupted.

ESET researchers have been “sinkholing” several domain names that control the botnet’s actions, replacing them with machines that do not send the botnet’s slave computers the commands they expect, but simply monitor botnet activity. Based on this data and ESET telemetry, ESET estimates that at least 35,000 devices became infected with VictoryGate at one point or another during this campaign.

The only infection vector used for spreading VictoryGate is via removable devices. “The victim receives a USB drive that at some point was connected to an infected machine. It seemingly has all the files with the same names and icons that it contained before being infected. Because of this, the content will look almost identical at first glance. However, all the original files were replaced by a copy of the malware,” says ESET researcher Alan Warburton, who investigated the botnet. “When an unsuspecting user attempts to open one of these files, the script will open both the file that was intended and the malicious payload.”

Warburton also warns about the impact on victims’ machines: “There is very high resource usage by the botnet, resulting in a constant 90% to 99% CPU load. This slows down the device and can cause overheating and possible damage.”

According to ESET research, VictoryGate has made a much greater effort to avoid detection than in previous, similar campaigns observed in the Latam region. And, given the fact that the botmaster can update functionality of the payloads that are downloaded and executed on the infected devices from cryptomining to any other malicious activities at any given time, this poses a considerable risk. This is particularly true since many of the victims identified were in either the public sector or in financial institutions.

If you suspect your device may have been infected with this malware, you can use our free ESET Online Scanner to clean your machine. The first-stage module is detected by ESET security products as MSIL/VictoryGate.

The peak number of unique IP addresses connecting to the botnet command and control server per day.

For more technical details about the VictoryGate botnet, read the blogpost Following ESET’s discovery, a Monero mining botnet is disrupted on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

VEGAS Pro 16 released – More power, more speed, more creative freedom

A high-performance video engine, intelligent workflow enhancements, and powerful, state-of-the-art editing features solidify VEGAS Pro as a cutting-edge tool for the professional market.

08/27/18 VEGAS Creative Software delivers next-generation video editing with the release of VEGAS Pro 16. With a high-performance video engine, intelligent workflow enhancements, and long-awaited, state-of-the-art editing features, the fastest video editor on the market is now packed with more power, speed, and innovation.

VEGAS Pro 16 delivers the groundbreaking improvements to solidify the software’s well-earned reputation as the leader for professional video creation. It now includes professional-level Video Stabilization so that even the shakiest camera footage can be salvaged with ease, and cutting-edge Motion Tracking so that any object on screen can be tracked and edited with a range of options and filters and effects can be added to tracked objects for color grading, blurring, pixelization, and more. Powerful Dynamic Storyboarding features enable the creation and organization of rough cuts and alternate sequences with a speed unrivaled by any other video editor. Multiple Storyboards allow for easy experimentation with different video cuts, allowing users to quickly switch between alternate project edits to compare and create. VEGAS Pro 16 now offers an end-to-end workflow for High Dynamic Range color (HDR) so it is compatible with professional HDR-capable cameras, monitors, and other hardware. Now VEGAS Pro users can deliver HDR content with stunning color and detail along with important metadata. Full 360° video support has been introduced so 360º video productions can be edited to meet the growing demands of the emerging VR market.

With these headline additions, plus a wide array of other new features (see below) VEGAS Pro 16 is now, more than ever before, the logical choice for fast, intuitive, and creative, professional-level video productions.

Gary Rebholz, Product Owner for VEGAS Pro says: “VEGAS Pro has always been the fastest way to create professional videos, but with version 16 we’ve once again set the bar for professional video and audio production. With innovative features and efficient workflow additions, including several important tools and options the VEGAS Pro community has been waiting for, we’ve taken the next critical step in building the new-generation video editor. The fastest video editor on the planet just got even faster!”

VEGAS Pro 16: major new features in detail

Motion Tracking

VEGAS Pro 16 features a powerful, native motion tracking tool that enables the user to track the movement of an object through the video frame and edit it with a range of options. For the first time ever, this allows VEGAS users to apply spot color grading, pixelization, or isolated color grading and correction to moving objects. Also, it is possible to “pin” titles to the tracked object so that text automatically follows movement. The new motion tracking opens a variety of exciting possibilities for projects, especially in combination with the Bézier Masking tools, filters, and effects.

Video Stabilization

The world-class video stabilization engine has been designed from the ground up with the latest technology. This results in faster, more efficient, and more accurate stabilization than in previous versions of VEGAS, even with 4K media. The redesigned video stabilization is an essential tool for modern handheld production techniques and offers speed, simplicity, and a nondestructive workflow with flexible settings to achieve precise results. It’s also been designed to take advantage of newer multicore processors, so owners of high-powered, modern PCs can enjoy speed and precision.

Dynamic Storyboarding

This powerful tool speeds up the cutting process and fosters creativity. Dynamic Storyboarding can be used to easily assemble rough cuts and alternate sequences so multiple ideas can be compared quickly. Thanks to the interconnected storyboard and timeline, any edits made on the main storyboard are directly reflected in the project timeline, while multiple additional storyboards allow for experimental edits and cuts.

Additional Workflow Enhancements

The further improved Hover Scrub feature makes it incredibly easy to locate specific video frames using a mouse with a thumbnail of the project in the Media Window. Project Media thumbnails can now be adjusted in size, enabling finer Hover Scrubbing and more accurate location of specific video frames. Users can now drag a bin to the timeline, including all of the media in storyboard bins, in order to add video events into the project timeline simultaneously rather than having to add files individually.

Full HDR Support

With High Dynamic Range (HDR) support, users can now take advantage of the latest advances in color technology to deliver amazing HDR quality including ultra-realistic video with stunning colors, richly textured blacks, and even the detail in bright spots that may have been blown out before. All aspects of the HDR workflow are covered including import, real-time HDR preview, HDR-aware video scopes, render to HDR with metadata, and even integrated, one-click HDR publishing directly to YouTube. It is now possible to complete a project from start to finish in full HDR with VEGAS Pro 16.

Complete 360° Compatibility

VEGAS Pro 16 includes support to meet the growing demands of the 360º video market. It includes templates for many of the most popular cameras such as the Samsung Gear 360, LG 360° cam, and Ricoh Theta. Users have the option to match their project properties to their 360º footage. VEGAS Pro 16 can stitch together dual-fisheye video and import 360° video stitched by cameras or other software. The workflow allows you to render 360º video files including Scene Rotation or the Tiny Planet effect.

Comprehensive file backup options

VEGAS Pro 16 offers the flexibility of multiple options when it comes to backing up projects, so if a user is working on a complex project, or one that is pushing the very limits of their PC, they can enjoy complete peace of mind. Users can back their work up after a set time which can be determined in minutes and hours, as well as daily backups. Projects can be saved and backed up automatically after every edit. All backups can be saved to the same folder as the project file, a temporary location, or any user-defined location.

Four ways to enjoy VEGAS Pro 16

VEGAS Pro 16 is available in four versions. VEGAS Pro 16 Edit is the base option, but still offers the complete VEGAS Pro feature set including all the new features such as Motion Tracking, Video Stabalization, and HDR Support. VEGAS Pro 16 is the standard version with additional software including Boris FX Continuum Lights Unit plug-in (a $195 value) for incredible lighting effects, proDAD VitaScene V3 LE (a $199 value) with 100 video effects, and VEGAS DVD Architect for professional DVD and Blu-ray authoring. VEGAS Pro 16 Suite is the ultimate video-editing package with all the new features and professional extras including the FXhome HitFilm Ignite Pro (a $200 value) bundle’s 180 plug-ins, the proDAD VitaScene V3 PRO (a $599 value) package of around 700 effects, and the Boris FX Sapphire Lighting Unit (a $595 value) set of spectacular natural and synthetic lighting effects. With VEGAS Pro 365, users get all the power and functionality of the regular VEGAS Pro 16, but enjoy future updates immediately upon release, full support, plus the VEGAS Pro 365 exclusive plug-in FXhome HitFilm Ignite 360 Toolkit (a $49.99 value) all for a low monthly fee.

VEGAS Pro 16 is now available online and in stores worldwide. Learn more at https://vegascreative.hk/product-category/vegaspro/

ESET Foundation has supported development of a diagnostic PCR test to detect the coronavirus SARS-CoV-2, the cause of COVID-19.

BRATISLAVA, April 14, 2020 – Scientists from the Slovak companies MultiplexDX, Lambda Life and ProScience Tech have joined forces with virologists from the Biomedical Center of the Slovak Academy of Sciences (BMC SAV) to develop a reagent kit according to World Health Organization (WHO) protocols for reliable SARS-CoV-2 detection. In the first phase they plan to produce and make available 100,000 PCR tests. The ESET Foundation supported the development of the kit and will finance the first 100,000 tests to be offered as an in-kind gift to the Slovak Republic.

Key components have been brought to the project by MultiplexDX, a company dedicated to developing and manufacturing various innovative molecular diagnostic reagents. The Slovak PCR test is currently being validated in cooperation with a team of scientists from the BMC SAV. Preliminary results of the new test not only show nominal functionality, but also good sensitivity compared to currently used diagnostics. “This means that our test is reliable and accurate and can help diagnose early stage patients. We can produce key components for 100,000 PCR tests within two weeks,” explained Pavol Čekan, founder of MultiplexDX.

“In the process of validation and subsequent registration of the resulting report, we are cooperating with the non-profit organization CCCT SK. This stage is estimated to take about three weeks,” said Adam Andráško of ProScience Tech.

“Virus detection consists of sample collection, RNA isolation and PCR diagnostics, with our joint efforts focused on the last step,” said Ivan Juráš of Lambda Life.

“I believe that the efforts of our scientists will be crowned with success, and that we will have sufficient PCR tests from our own resources for the task at hand, coronavirus detection. This will not only help Slovakia by providing much-needed testing, but will also create a reserve in case there is a shortage of tests globally,” noted Robert Mistrík from the permanent crisis staff.

The ESET Foundation supported the development of the test and provided funding for the first 100,000 units from its fund to support the effective diagnosis and prevention of COVID-19. These tests will be offered as a gift to Slovak state institutions. “When creating the fund, it was important for us to ensure effective mass-scale diagnostics, which can only be achieved through scientific cooperation. Such a critical situation reveals the importance of supporting science in Slovakia, which the ESET Foundation has been dedicated to for a long time,” said Richard Marko, CEO of ESET.

Production capacity, including the first 100,000 tests, will be available primarily to diagnostic laboratories on the Slovak market. “We are ready to cooperate with state laboratories, flexibly responding to their needs and supplying them efficiently. After satisfying the needs of Slovak laboratories, we can then direct our capacities to other countries that may need our products,” explained the authors of the test.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

AV-Test recognizes ESET Endpoint Security in 2019 Awards

BRATISLAVA – ESET, a global leader in cybersecurity, has been recognized in the AV-TEST Awards 2019 for outstanding IT protection. AV-Test, a leading independent testing organization, uses one of the largest collections of digital malware samples in the world, the Institute’s own research department, as well as intensive collaboration with other institutions, to guarantee tests […]

Continue reading

ESET named a Top Player in Radicati’s Market Quadrant for APT Protection

BRATISLAVA – Global cyber security leader ESET has been recognized as a ‘Top Player’ in Radicati’s 2020 Market Quadrant APT Protection Report, covering the Advanced Persistent Threat (APT) Protection segment of the Security Market. This is the first time ESET has been recognized in this specific Radicati report, after placing as a ‘Top Player’ in […]

Continue reading

ESET unravels unique obfuscation techniques

ESET researchers bring unique obfuscation techniques to light, aiming to help the cybersecurity industry improve protection against sophisticated threats. BRATISLAVA – ESET researchers have analyzed and described in detail several techniques used by malicious actors to thwart analysis and avoid detection of their malware. These custom obfuscation and detection evasion techniques were discovered in the course […]

Continue reading

Boot Backup Images Instantly With NetJapan’s Interim Availability Solution HyperBoot™

Download PDF

Tokyo – NetJapan, Inc., publisher of disk imaging backup, system disaster recovery, and virtualization software, announces the release of HyperBoot™. A solution for booting ActiveImage Protector™ backups as virtual machines on Hyper-V and ESXi hosts by providing an interim availability solution to bridge the gap between disaster and recovery.

Using NetJapan’s real-time virtual conversion technology, HyperBoot bypasses the lengthy, resource intensive, and cumbersome physical to virtual conversion process, and boots the backup as a virtual machine in as little as two minutes. Changes made while running the virtual machine from a backup are saved as differential backup files. A proverbial “Spare Wheel” for recovering, migration testing, repairing, or upgrading prior to actual deployment.

Use VMware vMotion Live Migration to effect “recovery on boot” of a HyperBoot virtual machine to a hypervisor in a production environment.

Features:

  • Boot backups created by all versions and editions of ActiveImage Protector including agentless, and Linux LVM images.
  • Supports booting on Hyper-V (Local and Remote), ESXi, VMware Workstation/Player, and VirtualBox.
  • Available at no additional charge for ActiveImage Protector users.

 For further product information and system requirements, please visit: https://www.netjapan.com/en-us/backup-dr-solutions/free-tools/#hyperboot

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Actiphy
Actiphy founded in 2007, focuses on developing and offering innovative backup and disaster recovery solutions for complete protection of all your systems and data. ActiveImage Protector backs up Windows, Linux machines on physical and virtual environments and restore systems and data fast for you to be up and running with minimal downtime and data loss. Today Actiphy hold 20% of the image backup market in Japan and are expanding our services in the Asia/Pacific and North American regions, as well as in Europe, the Middle East and Africa.

ESET expands its protection for businesses with Endpoint Antivirus for Linux

BRATISLAVA – March 17, 2020 – ESET, a global leader in information and cybersecurity, has today launched the latest version of ESET Endpoint Antivirus for Linux, ensuring all organizations are protected to the highest standard, no matter the operating system. Endpoint Antivirus for Linux joins ESET’s extensive product range, which already caters extensively to Windows […]

Continue reading