Back 
We recently published an overview blog about the CloudFanta malware campaign that uses the Sugarsync cloud storage app to deliver malware capable of stealing user credentials and monitoring online banking activities. This blog will detail the technical aspects of CloudFanta.
Although CloudSquirrel and CloudFanta malware are not similar, we believe that both malware campaigns are deployed by the same actor based on the following similarities.
- Use of cloud services to download and deliver the malware and its payloads.
- Infecting users by downloading malicious payloads (32-bit and 64-bit executables) for performing data exfiltration.
- Targeting Brazilian users with the usage of similar file names such as NF-9944132-br.PDF.jar and the parameters used to communicate with the C&C server.
Propagation / Delivery of CloudFanta
CloudFanta malware typically arrives on the user’s machine as an attachment or a link via a spear phishing email that lures the victim to execute the file or click on the link.
The Sugarsync URL we observed delivering CloudFanta malware was at https://www[.]sugarsync[.]com/pf/D3202366_07280196_66523?directDownload=true.
The downloaded zip archive “NF-9944132-br.zip” contained a downloader JAR file “NF-9944132-br.PDF.jar” with the dual extension “.PDF.jar.” The files retrieved by this downloader JAR are detected by Netskope Threat Protection as Backdoor.Generckd.3549404, Backdoor.Generckd.3540808, Backdoor.Generckd.18673650, Backdoor.Generckd.3542220 and Gen:Variant.Symm.60013.
The visual depiction of protection from CloudFanta malware with Netskope Threat Protection is shown below.
Visual depiction of protection from CloudFanta malware with Netskope Active Threat Protection
Analysis of the Downloader JAR file
The JAR file contained the downloader functionality in the class file “Fanta_Uva.class” and was also packaged with several other class files to hinder the analysis as shown in Figure 1.
Figure 1: Files present inside the package of NF-9944132-br.PDF.jar
The decompiled code of “Fanta_Uva.class” illustrating the downloader functionality is shown in Figure 2.
