Cisco Talos and Flashpoint have teamed up to conduct an in-depth analysis of Floki Bot, a Zeus-based banking Trojan that has been sold on cybercrime marketplaces since September 2016.
Floki Bot, offered by its developers for $1,000 worth of bitcoins, is based on the Zeus source code that was leaked in 2011. However, researchers determined that the malware includes some new capabilities, including anti-detection features. Talos also spotted new code that allows the Trojan to use the Tor network, but the functionality is currently not active.
Flashpoint analysts believe that “flokibot,” the online moniker used by the threat actor behind the Floki Bot malware, is based in Brazil. Researchers determined that the actor communicates in Portuguese, it targets Brazilian IPs and domains, and it’s mainly interested in devices with the default language set to Portuguese. The actor appears to be most active on underground forums during hours within Brazil’s UTC -3 timezone.
Flashpoint has named the flokibot actor a “connector”, as they are present on several major underground communities outside of Brazil, particularly Russian- and English-speaking dark web communities.
Researchers believe that through their presence on these foreign websites, the cybercriminals import knowledge and tools into the Brazilian community.
“While Brazilian cybercriminals are not typically as technically sophisticated as their Russian counterparts, they will often solicit new forms of malware (to include point of sale [PoS] ransomware and banking Trojans), or offer their own services,” Vitali Kremez, senior intelligence analyst at Flashpoint, said in a blog post. “It appears that a presence on Russian [Deep and Dark Web] communities may be a likely factor in flokibot’s progression.”
In addition to the banking Trojan functionality borrowed from Zeus, researchers noticed that Floki Bot includes hooking methods designed to capture payment card data from memory. In one campaign analyzed by Flashpoint, 225 Floki bots appeared to have collected a total of 1,375 card dumps.
“For connectors like flokibot, reaching across language barriers into predominantly English- and Russian-language communities enables them to to advance criminal schemes through new markets: it is not particularly difficult or expensive for botnet newcomers in short time to build their own botnets leveraging Floki Bot and start attacking corporate networks,” Kremez said.
Talos has published a detailed analysis of how Floki Bot works and released a tool designed to make it easier for analysts to examine the malware.
Related Reading: Fully Operational TrickBot Banking Trojan Targets UK, Australia
Related Reading: Dyre Authors Apparently Working on New Banking Trojan
Related Reading: Version 3 of Qadars Trojan Targets UK Banks