Threat video1:00
Recorteiro Rust Banker Screen Overlay: Detection & IOCs
Recorteiro lures Portuguese victims with fake electricity bills, then drives the screen remotely. 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for Recorteiro Rust Banker Screen Overlay: Detection & IOCs →
Chapters
- 0:00The hookFake electricity bills hide a Rust banking trojan.
- 0:04The storyEarliest public disclosure came in November.
- 0:11Attack pathThe chain, reported, opens with a batch file.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise3 indicators to hunt: 1 domain, 1 registry key and 1 c2 framework.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from execution to command and control.
- 0:43Remediation5 steps now: Block windowshelpers[.]com at DNS and proxy and alert on any.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake electricity bills hide a Rust banking trojan.
0:05Earliest public disclosure came in November.
0:08It targets Portuguese banks, stealing sessions.
0:12The chain, reported, opens with a batch file.
0:15Then a PowerShell dropper runs.
0:17It persists via registry, task and service.
0:20Next it downloads an encrypted core.
0:22It steals browser credentials.
0:27No threat actor is attributed. Confidence: low.
0:323 indicators to hunt: 1 domain, 1 registry key and 1 c2 framework.
0:3818 ATT&CK techniques, from execution to command and control.
0:445 steps now: Block windowshelpers[.]com at DNS and proxy and alert on any.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.