[c0d3inj3cT]

Client Maximus Banking Trojan is an interesting modular Banking Trojan that involves several layers to perform malicious activities.

Attack flow is: RAR -> LNK -> Powershell -> .NET modules downloaded and executed.

It includes a Geo IP check as well for Brazil.

RAR file MD5 hash: d1ae4ff4f632d4f5e310ca17b084b55e

http://www.pwncode.club/2017/10/client- ... tacks.html
https://securityintelligence.com/brazil ... he-mayhem/

[maddog4012]

binary attached

[Ludvig]

can you share anothe files which malware was downloading

Code: Select all

/?fn
/?exe
/?cfg
/?bin
/?dll32
/?dll64
/?t
/?dllb
/?dllf