A sophisticated new banking Trojan targeting financial platforms uses advanced evasion techniques and self-propagating worm modules This article explores elastic malware. . TCLBANKER spreads through WhatsApp The infection sequence begins by abusing a legitimately signed Logitech application, the Logi AI Prompt Builder, to execute a malicious payload via DLL sideloading.
By evaluating system disk information, running processes, debugging tools, and verifying that the system language is set to Brazilian Portuguese, the malware generates a unique environment hash. File directory listings reveal malicious DLLs (Source: elastic) Malware that detects security sandboxes or analysis tools generates incorrect hashes, preventing decryption and halting execution without detection. A dedicated monitoring system continuously scans for analysis frameworks to remain hidden from researchers while establishing persistence through scheduled tasks.
Patching via EtwEventWrite (Source: elastic) Once the primary banking trojan is deployed, it actively monitors a victim’s foreground web browser using user interface automation. According to Elastic research, the rapid spread of TCLBANKER is fueled by its secondary worm module that exploits two distinct spam agents through trusted communication channels. By sending malicious links directly from the victim’s account to their personal contacts, attackers bypass traditional security measures and exploit trust among individuals.
