Jumcar. Timeline, crypto, and specific functions. [Second part]Jumcar stands out from other malicious code developed in Latin America because of its particularly aggressive features. At the moment three generations of this malware family exist, which basically use symmetric algorithms in the first and second generation, and an asymmetric algorithm in the third. In this manner the configuration parameters are hidden, progressively increasing the complexity of the variants.
In the first generation, data is encrypted with AES (Advanced Encryption Standard). We estimate that the first variant was released in March 2012, and that other pieces of malware with similar characteristics were being developed until August of the same year. That is to say over a six month period.
In this first stage, 75% of the phishing campaigns targeted Peruvian consumers that use home-banking services. The 25% remaining targeted users in Chile.
The following diagram shows multiple instances used by the second generation of Jumcar:
Some .NET instances used by a variant of the first generation of JumcarSource:
Jumcar. Timeline, crypto, and specific functions. [Second part]
