Elastic Security Labs has identified a banking trojan called TCLBanker that targets Brazilian financial-service users and includes modules designed to spread phishing messages through WhatsApp Web and Microsoft Outlook accounts.
Elastic said the malware targets 59 Brazilian banking, fintech and cryptocurrency domains. The company tracks the campaign as REF3076. Researchers described checks of a computer’s timezone, keyboard layout and locale designed to restrict execution to systems with Brazilian settings.
Debug logging paths, test process names and an incomplete phishing page suggested the campaign was discovered at an early operational stage, Elastic said.
Malicious installer imitates Logitech software
Elastic said the observed infection chain begins with a ZIP archive containing a malicious MSI installer posing as Logitech’s Logi AI Prompt Builder. The package uses a legitimate Logitech application to load a malicious DLL through a technique known as DLL side-loading.
The DLL masquerades as a plugin and runs when the application starts, the researchers said. Their analysis describes a loader that deploys a banking component and a separate propagation component.
Browser monitoring and fake screens
Elastic said the banking module checks browser address bars every second using Windows UI Automation APIs. A visit to a targeted domain triggers a WebSocket connection to command-and-control infrastructure, which receives information about the user and system and supports remote-control commands.
The researchers said the malware terminates Task Manager during active sessions. They also described a WPF-based overlay system that can display fake credential prompts, PIN keypads, phone-number forms, bank-support waiting screens, Windows Update screens and progress screens.
Elastic said cutout overlays expose selected portions of a real application while covering the surrounding screen, placing the application within a false interface.
Spreading through WhatsApp and Outlook accounts
Elastic said it recovered two propagation variants: one for WhatsApp Web and another for Microsoft Outlook. The modules are designed to make an infected computer a distribution point for phishing messages sent through the victim’s accounts.
The WhatsApp variant uses an authenticated web session as a delivery channel, Elastic said. It searches Chromium browser profiles for WhatsApp Web session data stored in IndexedDB, clones a matching profile and launches a hidden browser instance. If the session resumes, it collects contacts, filters for Brazilian phone numbers and sends messages directing recipients to malware distribution pages, the researchers said.
The Outlook variant uses COM automation to launch the installed email application, collect contacts and email addresses from inbox senders, and send phishing emails through the victim’s accounts, Elastic said.
Checks designed to hinder analysis
Elastic said TCLBanker’s loader ties payload decryption to environmental checks, so a failed check can prevent the embedded modules from decrypting correctly. The researchers also described a watchdog that monitors for debuggers, reverse-engineering tools, instrumentation frameworks and process-inspection utilities.
Elastic assessed TCLBanker as a major update of the older Maverick/Sorvepotel malware family.
