{"id":17455,"date":"2020-01-15T11:40:30","date_gmt":"2020-01-15T19:40:30","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2020\/01\/15\/news-11191\/"},"modified":"2020-01-15T11:40:30","modified_gmt":"2020-01-15T19:40:30","slug":"news-11191","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2020\/01\/15\/news-11191\/","title":{"rendered":"Deep Analysis of New Metamorfo Variant Targeting Customers of Brazilian Financial Organizations"},"content":{"rendered":"
\n
\n

A FortiGuard Labs Threat Analysis Report<\/i><\/b><\/p>\n

FortiGuard Labs recently captured a suspicious sample from a phishing email. After a quick analysis, I determined that this was a new variant of the Metamorfo malware, which was known for collecting data from the customers of Brazilian financial organizations.<\/p>\n

In this analysis, I will elaborate what this new variant of Metamorfo does and what data it collects from a victim\u2019s machine, as well as how it communicates with its command and control (C&C) server.<\/p>\n

Spreading in a Phishing Email<\/h2>\n

The email content was in Portuguese, which is the official language of Brazil. The email content is translated into English in Figure 1. It was disguised as a notice asking the victim to download an Electronic Invoice (NF). When moving a mouse over the blue download button, the file download URL is shown in the status bar.<\/p>\n<\/p><\/div>\n