Top Tweets for #KLBanker
@0xToxin @crocodylii Interesting find !!
VCRUNTIME140.pdb reminds me of #KLBanker as well since the DLL was often named like that.
Do you have any hashes for your sample? Would love to have a look π
#KLBanker
The ZIP file downloaded by the MSI file is still hosted on firebasestorage.googleapis[.]com, config on pastebin[.]com
CTT-MAIO.094-CN.56.msi
88198cab3c51396900f3cf2f4022c703
New Check-in: http://xclientesx.francecentral.cloudapp[.azure[.com/x10/index.php
![StopMalvertisin's tweet photo. #KLBanker
The ZIP file downloaded by the MSI file is still hosted on firebasestorage.googleapis[.]com, config on pastebin[.]com
CTT-MAIO.094-CN.56.msi
88198cab3c51396900f3cf2f4022c703
New Check-in: http://xclientesx.francecentral.cloudapp[.azure[.com/x10/index.php https://t.co/WqPEA2MsQF](https://pbs.twimg.com/media/FwUKOCOaYAA2ONm.jpg)
#KLBanker is still in active development. The TA added a forced reboot in order to hinder Sandbox analysis.
RTC-MAIO.395-LS.96.msi
af613de3027041ff1d357d45fe02681b
#KLBanker
981148 .zip
f01ca59595642dc1fb45b9eb4c0a45b5
A.T.Comparecimento-40.480.msi
b61e51f1afb38343a23136f4bb3c3ec1
https://firebasestorage.googleapis[.]com/v0/b/doloog-3e542.appspot.com/o/famins.csv?alt=media&token=03c16ea4-2eda-41bc-b092-7996263f0f3a
![StopMalvertisin's tweet photo. #KLBanker
981148 .zip
f01ca59595642dc1fb45b9eb4c0a45b5
A.T.Comparecimento-40.480.msi
b61e51f1afb38343a23136f4bb3c3ec1
https://firebasestorage.googleapis[.]com/v0/b/doloog-3e542.appspot.com/o/famins.csv?alt=media&token=03c16ea4-2eda-41bc-b092-7996263f0f3a https://t.co/Da7729tPjY](https://pbs.twimg.com/media/FvHDLYoaAAAEKRl.png)
![StopMalvertisin's tweet photo. #KLBanker
981148 .zip
f01ca59595642dc1fb45b9eb4c0a45b5
A.T.Comparecimento-40.480.msi
b61e51f1afb38343a23136f4bb3c3ec1
https://firebasestorage.googleapis[.]com/v0/b/doloog-3e542.appspot.com/o/famins.csv?alt=media&token=03c16ea4-2eda-41bc-b092-7996263f0f3a https://t.co/Da7729tPjY](https://pbs.twimg.com/media/FvHDJVVaUAEpSes.png)
![StopMalvertisin's tweet photo. #KLBanker
981148 .zip
f01ca59595642dc1fb45b9eb4c0a45b5
A.T.Comparecimento-40.480.msi
b61e51f1afb38343a23136f4bb3c3ec1
https://firebasestorage.googleapis[.]com/v0/b/doloog-3e542.appspot.com/o/famins.csv?alt=media&token=03c16ea4-2eda-41bc-b092-7996263f0f3a https://t.co/Da7729tPjY](https://pbs.twimg.com/media/FvHDHTcagAE4Ige.png)
![StopMalvertisin's tweet photo. #KLBanker
981148 .zip
f01ca59595642dc1fb45b9eb4c0a45b5
A.T.Comparecimento-40.480.msi
b61e51f1afb38343a23136f4bb3c3ec1
https://firebasestorage.googleapis[.]com/v0/b/doloog-3e542.appspot.com/o/famins.csv?alt=media&token=03c16ea4-2eda-41bc-b092-7996263f0f3a https://t.co/Da7729tPjY](https://pbs.twimg.com/media/FvHDEPcakAAxEl7.png)
#KLBanker DLL using ConfuserEx
7c11ede01d1c8183c91a69459159ab93
@1ZRR4H @luigi_martire94 @JAMESWT_MHT @pollo290987 @sirpedrotavares @dark0pcodes
#KLBanker DLL's using ConfuserEx
63dce810fe50aa1029e196d9a1d4ffac
bc5d167ef491c3642a980a8b79aba1a4
cc @sirpedrotavares @pollo290987
#KLBanker
In this sample the Banker DLL is over 4MB instead of around 1MB.
Protection: invalid code to the methods so that decompilers cannot interpret them. Example AntiDecompiler Cleaner hosted on Github.
Didn't contact paste4btc or pastebin to fetch config info
This blog gets into the nuances of the Brazilian Banking #Trojan, #KLBanker, which has resurfaced with few changes to its existing code. Explore more at https://t.co/uGbbuGNZ2Y
#K7Security #cybersecurity #CyberSecurityAwareness #malware #Blog
.NET #KLBanker with DNGuard HVM (.Net obfuscator and code protection)
MSI: https://t.co/pxUnK9qM6f
ZIP: https://s3.eu-west-3.amazonaws[.]com/rmw.ptgh/mprs.dsnt/prlf.mjrt/pictures200.zip
Current Payload (1): https://t.co/99pm4GejHj
Banker DLL: https://t.co/cSKbpSDyEe
![StopMalvertisin's tweet photo. .NET #KLBanker with DNGuard HVM (.Net obfuscator and code protection)
MSI: https://t.co/pxUnK9qM6f
ZIP: https://s3.eu-west-3.amazonaws[.]com/rmw.ptgh/mprs.dsnt/prlf.mjrt/pictures200.zip
Current Payload (1): https://t.co/99pm4GejHj
Banker DLL: https://t.co/cSKbpSDyEe https://t.co/UW2RFYhzG3](https://pbs.twimg.com/media/Fdz14C9VUAAL2hj.png)
@StopMalvertisin @1ZRR4H @dark0pcodes @luigi_martire94 Mentioned #KLBanker samples uploaded
πππ
https://t.co/oI4zqd6YeH
#KLBanker now with DNGuard HVM (.Net obfuscator and code protection)
MSI: https://t.co/wPrASTRK0e
ZIP: https://planejamentodistrital.s3.eu-west-2.amazonaws[.com/dmfprobsl/coentros/diario2.zip
https://t.co/qLwgNMjuqD
@StopMalvertisin @pollo290987 @sirpedrotavares @1ZRR4H @luigi_martire94 @dark0pcodes mentioned .NET #KLBanker
ππππ
https://t.co/RX1YMUlHlR
.NET #KLBanker has undergone some changes compared to the last sample.
Ref: https://t.co/yhHGqUj7Zr
MSI: https://t.co/5mNgJWgHDf
ZIP: https://amoaobocowpis.s3.sa-east-1.amazonaws[.com/potos2.png
https://t.co/8NSopaLU6n
cc @pollo290987 @sirpedrotavares
Interesting .NET #Brazilian Banker ...
Possible #Janeleiro or maybe a #Mekotio .NET variant based upon the .PDB path containing "KL_FINAL" -> reference to "KL_Banker" ? which is another name for #Mekotio.
CustomAction in .MSI Installer
-> AI_Detect VM
-> AMJEJCNE is a Script
#Banking #Brazilian #malware maybe related with #Lampion.
By pdb: #KLBanker
Loader for W7 & W10
Antidebug
Banks: Santander, BBVA, BancoEstado
2 more samples related:
EncryptAndDecrypt: Used to enc/dec strings 3DES+CBC.
Clientes: Login for "Keylogger Banker"
π¨ Confirmed!!! CSIRT ALERT: #WinRar exploit CVE-2018-20250 spreading Banking Trojan in Chile, Latin America: https://t.co/xe3u9sgACx #N40 #KLBanker @Bank_Security @360TIC @malwrhunterteam @executemalware @James_inthe_box @JAMESWT_MHT
CSIRT informa sobre Alerta de Ciberseguridad por Malware EMOTET. Comunicado oficial con el detalle en: https://t.co/OxILpe6ALh
Last Seen Hashtags on Sotwe
LMOAI
Seen from United States
ipcam
Seen from Argentina
ΰΈΰΈ₯ΰΈΈΰΉΰΈ‘ΰΈ₯ΰΈ±ΰΈ
Seen from Thailand
sex snapchat
Seen from Colombia
anxiouspanda
Seen from United States
jordygarza
Seen from United States
minionsandmonsters
Seen from United States
analorgasms
Seen from Spain
wifesharing
Seen from Turkey
ζ°εε£η·ε£«
Seen from Philippines
Most Popular Users
Elon Musk 
@elonmusk
241.7M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.4M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
83.9M followers
Lady Gaga
@ladygaga
75.4M followers
Virat Kohli
@imvkohli
73.3M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers