Home Security IBM sleuths find banking trojan that uses MS-SQL as C&C server

Researchers at IBM's X-Force Research have discovered a Windows banking trojan that is unusual in one major respect: it uses a Microsoft SQL Server database server as its command-and-control server.

The malware, named MnuBot, is concentrated in Brazil. No indication was given of the vector it uses to infect a Windows machine.

Most malware use either a Web server or an Internet relay chat channel as the C&C server. There are some variations: the recently discovered VPNFilter malware used a site known as photobucket[.]com as its primary C&C server and loaded an image in order to obtain an IP address for its next stage of operation.

The trojan creates a file called Desk.txt within the AppData Roaming folder and creates a new desktop instance, switching the user over to that and letting the existing desktop instance run side by side. If there is already a Desk.txt file on the system, then MnuBot does nothing.

It then monitors activity on the desktop and waits for the user to open an online banking site, carrying out continuous checks to see if the bank name matches one of those in its configuration which it downloads from the SQL Server C&C server..

If that happens, then the trojan asks the C&C server for a second-stage executable which is saved as Neon.exe in the C:\Users\Public folder.

This executable provides the attacker with full control over the infected machine. If MnuBot cannot obtain a configuration file, then it stays quiet on the infected machine and does nothing. The credentials for connecting to the SQL Server are stored in encrypted form and decrypted just before a connection is attempted.

This achieves two goals:

Dynamic configuration: At any time, the attackers can dynamically change MnuBot’s malicious activity (e.g., the banking sites that are targeted); and

Anti-Research: Once the attackers take down the server, it becomes almost impossible for a researcher to reverse engineer the behaviour of the malware sample.

The attacker has the following range of activities at his/her disposal:

  • Creating browser and desktop screenshots;
  • Keylogging;
  • Simulating user clicks and keystrokes;
  • Restarting the infected machine;
  • Uninstalling Trusteer Rapport from the system; and
  • Creating a form to overlay the bank’s forms and steal the data the user enters into the form.

Commenting on the trojan's design, researcher Jonathan Lusky said it was likely that the MnuBot authors wanted to evade regular anti-virus detection, which is based on malware traffic.

"To do so, they decided to wrap their malicious network communication using seemingly innocent Microsoft SQL traffic," he said.

"MnuBot is an excellent example of many malware families in the Brazilian region. It has many characteristics that are typical of other recently discovered malware strains. For example, the overlaying forms and the new desktop creation are well-known techniques that malware authors in the region use today."


Our Mesh WiFi system MW3 is the first in Australia market with price below AUD$200 for a set of three.

· Best valued product
· Strong signal covering up to 300m2 for MW3 and 500m2 for MW6
· Aesthetically pleasing and light weigh (blend into any room deco)
· Wireline backhauls supported
· Product units are pre-paired and easy to setup
· Not requiring phone number or email address to set up
· Wall penetration (better than other similar brands)
· Seamless WiFi roaming
· User friendly app with controls to setup a guest network, parental controls for disabling groups of devices you allocate to individuals, QoS and more



Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

· How does business security get breached?
· What can it cost to get it wrong?
· 6 actionable tips


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the sitecame into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.


Popular News




Sponsored News