Ofuscação em malwares bancário no Brasil: um estudo de caso sobre o trojan Banbra

Abstract

Technological advancement has enabled many banking systems to undergo an extensive modernization process, making communication with users more intuitive. Such changes have made it possible for the majority of banking transactions today to be conducted virtually. However, along with these conveniences, malicious mechanisms have also emerged, aiming to collect and use the personal information of users of these financial platforms, causing financial losses and disruptions. These mechanisms, known as banking trojans, are divided into families, each presenting distinct characteristics and behaviors. One of the techniques used by this type of malware involves the abuse of files in the .cpl format; this technique serves as a method for evading threat detection mechanisms and for disguised execution. Based on reports from specialized platforms, the banking trojan most frequently associated with the use of this technique is Banbra. Although various detection techniques for this type of threat have been developed over time, a significant presence of these trojan families persists, even after many years. This work aims to analyze and map the characteristics and obfuscation techniques of the banking trojan belonging to the Banbra family. The analysis was conducted by observing the scripts within the malicious files, focusing on identifying unique obfuscation techniques that hinder detection by traditional tools. The analysis revealed a sophisticated multi-stage obfuscation architecture, in which the outer layer consisted of the use of a packer to compress the code. Beneath this layer, a series of active evasion tactics were identified, such as anti-analysis techniques and environment reconnaissance. The application of reverse engineering through debugging made it possible to bypass these protections and extract the final payload. This investigation may serve as a foundation for future studies aimed at developing more effective detection mechanisms capable of adapting to the strategies employed by this family of banking trojans.