Summary
A new banking trojan called TCLBanker is being distributed by threat actors who are abusing a signed Logitech installer to evade detection and infect victims. The attackers use a legitimate-looking email with a malicious attachment that, when opened, drops the TCLBanker loader component onto the victim's system.
Key Points
-
Distribution Method:
- Threat actors send emails containing a ZIP file with a fake invoice or document.
- The ZIP file contains a signed Logitech installer (logi.exe) which is used to drop the malicious payload.
-
Malware Components:
- Loader Component:
screen_retriever_plugin.dll - Initial ZIP File:
XXL_21042026-181516.zip
- Loader Component:
-
C2 and Phishing Domains:
- C2 Domain:
campanha1-api.ef971a42[.]workers.dev - File Server:
documents.ef971a42.workers[.]dev - Under Development Phishing Pages:
arquivos-omie[.]com- `documentos-online
- C2 Domain:
Read the full article at Cyber Security News
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
2
Contents
Ali NematiWritten by Ali
![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)
