A recent cyberattack targeted a South Asian financial institution, using two custom malware components, BRUSHWORM and BRUSHLOGGER.
Discovered by Elastic Security Labs, the intrusion relied on a primary backdoor and a secondary keylogger to secretly compromise the banking environment.
BRUSHWORM Backdoor Operations
BRUSHWORM serves as the primary modular backdoor, operating via a malicious executable named paint.exe.
Upon execution, it performs simple sandbox evasion checks to detect security analysis tools. The malware terminates immediately if it detects low screen resolution, specific default usernames, or known hypervisor virtualization environments such as VMware.
The malware establishes long-term persistence by creating a Windows scheduled task called MSGraphics.
This hidden task ensures the backdoor runs automatically whenever a user logs in to the compromised machine. Once active, BRUSHWORM attempts to communicate with a remote command-and-control server to download additional malicious payloads.
To manage its operations, the malware creates specific hidden folders on the infected computer. These folders handle different parts of the attack, from storing the main program to holding stolen files.
| Directory Path | Operational Purpose |
|---|---|
C:\ProgramData\Photoes\Pics\ | Main installation folder for the backdoor binary |
C:\Users\Public\Libraries\ | Storage for downloaded modules from the C2 server |
C:\Users\Public\AppData\Roaming\Microsoft\Vault\ | Storage of the AES-encrypted configuration file |
BRUSHWORM also features a dangerous worm that can infect connected removable USB drives. It copies itself using enticing, socially-engineered filenames like Salary Slips.exe to trick financial sector employees.
At the same time, it scans the drives to steal valuable documents, spreadsheets, presentations, and source code.
If the infected machine lacks internet access, BRUSHWORM switches to a bypass strategy to evade network restrictions. It copies the stolen data directly onto the removable USB drives, creating a physical bridge to steal information from air-gapped networks.
BRUSHLOGGER Keystroke Capture
BRUSHLOGGER operates as a supplemental 32-bit Windows keylogger component that masquerades as a legitimate system file.
It disguises itself as libcurl.dll and executes through a covert technique called DLL side-loading. To prevent multiple versions from running at once, the keylogger uses a specific software mutex disguised as a standard Windows Update identifier.
The keylogger captures all system-wide user input by installing a low-level Windows keyboard hook.
It actively records every keystroke, along with a timestamp and the exact title of the active foreground window.
This detailed context tracking allows the attackers to easily map stolen passwords and messages to specific applications or secure websites.
Security researchers noted that neither malware binary uses advanced code obfuscation or complex packing techniques.
The overall quality of the programming is low, suggesting the elastic author might be inexperienced and possibly relied on artificial intelligence tools. Despite these flaws, the active servers and multiple testing versions indicate the threat actor is continuously refining this toolset.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
