Free real estate: GoPix, the banking Trojan living off your memory

MITRE Techniques

• [T1189 ] Drive-by Compromise – Malvertising campaigns via Google Ads deliver malicious landing pages and installers (‘use Google Ads to spread baits related to popular services like WhatsApp… and lure victims to malicious landing pages.’)
• [T1204 ] User Execution – Social engineering and fake installers (NSIS fake “WhatsApp Web installer”) trick users into running the payload (‘the victim will then be presented with a fake webpage offering to download advertised software, this being the malicious “WhatsApp Web installer”’).
• [T1105 ] Ingress Tool Transfer – Downloading of next-stage payloads and remote PowerShell scripts from malicious URLs (‘it will then return a JSON response with two URLs’ / ‘download and execute the next-stage payload from the malicious URL’).
• [T1059.001 ] PowerShell – Extensive use of obfuscated and memory-only PowerShell scripts to collect system info, retrieve JSON configs, decrypt shellcode, and execute dropper shellcode in-memory (‘obfuscated PowerShell script… decrypts the encrypted PowerShell script ps… the decrypted script is never loaded to disk.’)
• [T1027 ] Obfuscated Files or Information – Multiple obfuscation layers, encrypted shellcode, and encrypted strings in droppers and payloads to hinder analysis (‘strategic use of multiple obfuscation layers and a stolen code signing certificate’).
• [T1553.002 ] Code Signing – Use of a stolen digital certificate to sign NSIS installers to appear legitimate (‘digitally signed with a stolen code signing certificate issued to “PLK Management Limited”’).
• [T1055 ] Process Injection – Launching browser processes suspended via direct syscalls and injecting main GoPix shellcode into the browser process to run in-memory implants (‘the dropper uses direct syscalls to launch the chosen browser process in a suspended state… inject the main GoPix shellcode’).
• [T1056 ] Input Capture – Clipboard data theft and manipulation to intercept Pix, Boleto, and cryptocurrency addresses (‘clipboard stealing and replacing feature… when a Bitcoin or Ethereum wallet is copied to the clipboard, the malware replaces the address’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – C2 and payload downloads use HTTP/HTTPS to communicate and retrieve modules/configuration (‘the script obtains a JSON file containing GoPix modules and a configuration that is saved on the victim’s computer’).
• [T1557 ] Man-in-the-Middle – Use of malicious PAC files and injected root certificates to intercept and modify HTTPS traffic between victims and legitimate banking sites (‘the purpose of the PAC file in GoPix attacks is to manipulate the traffic… injects a trusted root certificate into the memory of a web browser’).
• [T1497 ] Virtualization/Sandbox Evasion – Abuse of legitimate anti-fraud/reputation services to detect sandboxes or analysis environments and avoid delivering payloads to non-targets (‘abuse legitimate anti-fraud and reputation services to perform targeted delivery of its payload and ensure that they have not infected a sandbox or system used in analysis’).
• [T1218 ] Signed Binary Proxy Execution / Living off the Land Binaries – Use of legitimate system utilities and techniques (e.g., LNK files, PowerShell, NSIS installers) to execute payloads and evade controls (‘Operating as a LOLBin (Living-off-the-Land Binary), GoPix exemplifies a sophisticated approach that integrates malvertising vectors’).
• [T1562.001 ] Disable or Modify Tools – Potentially disabling security software and using process checks to avoid non-browser processes when intercepting proxy connections (‘it then takes the process executable name CRC32C checksum and compares it with a hardcoded list of browsers… If it doesn’t match a known browser, the malware simply terminates the connection’ / ‘potentially disabling security software’).