Kaspersky unveils new malware targeting the financial and cryptocurrency sectors

Kaspersky experts have identified three new malware, Zanubis, AsymCrypt and Lumma, which pose a threat to the financial and cryptocurrency sector. The discovery of these new threats highlights the importance of strengthening digital security.

Zanubis: a banking trojan that hides under the guise of legitimate applications

Zanubis is a banking Trojan for Android devices that appeared in August 2022. This malware targets operators in the financial and cryptocurrency sectors in Peru and manages to deceive users by taking on the appearance of legitimate applications. Through social engineering, it convinces users to grant access permission to the device, thus taking complete control. Following an evolution in April 2023, Zanubis posed as the official application of the Peruvian government organization SUNAT (Superintendencia Nacional de Aduanas y de Administración Tributaria), demonstrating greater complexity in deception. This trojan also uses Obfuscapk, a popular obfuscation tool for Android APK files, to hide its presence and access users' device via the WebView feature, displaying a legitimate website.

AsymCrypt: a tool for targeting crypto wallets

AsymCrypt is a cryptor/loader that targets crypto wallets and is sold on underground forums. This malware is the evolution of a loader known as www.sisecam.com.tr, which acts as a front for a TOR network service. Buyers customize injection methods, target processes, startup duration, and stub types for malicious DLLs, hiding the payload within an encrypted .png image within an image hosting site . When executed, the image is decrypted and activates the payload in memory.

Lumma: an ever-evolving file stealer

Lumma is an evolving malware family, formerly known as Arkeie. This malware presents itself as a .docx to .pdf file converter and, once illicitly installed, activates a malicious payload when files with a double .pdf.exe extension are loaded. Over time, Lumma has continued to develop and gain new features, maintaining a number of key features such as stealing cached files, configuration files, and logs from crypto wallets. Lumma can act as a browser plugin but also supports the Binance application. New versions of the malware are capable of capturing system process lists, modifying communication URLs, and improving the encryption techniques used.