The Statement That Wires Your Money Out: Inside a WhatsApp .img Banking-Malware Campaign

TechOwl Shield has analysed a live Windows banking-malware sample delivered over WhatsApp as a disk-image (.img) file, disguised as a bank statement or invoice with a message urging the recipient to open it on a computer and forward it to their finance team. We track the cluster internally as YOGI-IMG (antivirus family trojan.yogi); it is part of the India “Boss Scam” WhatsApp campaign reported by I4C and others.

The sample abuses a legitimately-signed binary to side-load a malicious DLL. That DLL is a first-stage downloader; the payload it fetches is what steals the money. What follows is the attack chain, the detection signals it produces, where attribution stands, and the controls that remove the largest parts of it.

Who is targeted

• Indian bank customers and — critically — finance teams, executives, and chartered accountants.
• Lures impersonate bank statements, invoices, “Reconciliation Confirmation,” KYC, and regulators (RBI, Ministry of Corporate Affairs).
• Delivery rides on trust: the file arrives from a known contact whose WhatsApp is already hijacked.

The attack chain

The decrypted C2 protocol

The downloader talks HTTP over TLS with User-Agent GeneratorApp/1.9.44, resolving its network (WinHTTP) and crypto (bcrypt) APIs at runtime and keeping its config encrypted — deliberate anti-analysis:

GET /sys/<build>/1/c2b8.zip                         ← next-stage payload pull
GET /r/<build>/download_fail?run_id=<YYYYMMDD-HHMM>  ← status callback

Observed execution timeline (Procmon)

08:50:40.869  INV-No.202608170.exe   Process_Start   loader starts
08:50:40.878  INV-No.202608170.exe   Load_Image      side-loads webview_support.dll (from ISO)
08:50:40.884  INV-No.202608170.exe   CreateFile      stages DLL+EXE -> C:\Users\Public\0F0236B4\
08:50:40.888  INV-No.202608170.exe   Process_Create  rundll32.exe "...\webview_support.dll",MpayWebviewSupportMain
08:50:40.897  rundll32.exe           Load_Image      loads the staged payload DLL
08:50:41.609  rundll32.exe           WriteFile       next stage -> C:\Users\Public\Documents\WU\c2b8.zip

Infrastructure and scale

Pivoting from the live C2 revealed an industrial operation, not a one-off:

• ~646 related samples communicating with the campaign's C2 domains (hundreds unique).
• 6 C2 base domains + ~13 subdomains across .img and .vbs delivery stages.
• Two dedicated hosting blocks on a single VPS provider (ASN 14956), a shared payload (webview_support.dll), and rotating side-load DLL disguises (libvlc.dll, lua51.dll, pcaui.dll…).
• Disposable, fast-rotating registration: every C2 domain is under 3 months old; several are DGA-flagged. Registrar suspensions on the older .vbs-stage domains show the operator being partially taken down and pivoting to the still-live .img-stage C2s.

Attribution

There is no named group behind this. It is an unnamed, financially-motivated cybercrime cluster (family trojan.yogi; the India “Boss Scam” campaign). Infrastructure naming points weakly toward a Chinese-speaking operator, at low-to-medium confidence: naming can be misdirection and is not, on its own, attribution. The tooling is commodity-grade but well-run, with no zero-days but effective signed-binary abuse, staged delivery, encrypted C2, and disposable infrastructure. It is distinct from the Brazilian WhatsApp bankers (Water Saci, TCLBANKER, Astaroth) and from Android KYC-lure campaigns.

Why banks specifically must care

• It abuses your brand (fake statements, KYC, RBI/MCA notices).
• It targets both your customers and your own finance and leadership staff.
• It defeats conventional controls: a signed binary, no exploit, social engineering, encrypted C2.
• The outcome is direct account drain and fraudulent wire transfers.

A bank statement or invoice that arrives over WhatsApp as a file to open on a PC should be treated as an attack on the finance team, not as a document.

Guidance for customers and staff

Detection and hunting

Atomic indicators (domains, hashes) rotate weekly, so detect the behaviour. The highest-fidelity signal:

Also hunt: ISO/.img mounted from a download or chat path; process staging to C:\Users\Public\<hex>\; a non-browser process reading WhatsApp or browser session stores; downloads to C:\Users\Public\Documents\WU\.

Recommendations

For bank customers

Banks never send statements, invoices, or KYC as .img, .exe, or .zip over WhatsApp. Don't open, don't forward, delete. Warn the sender that their account may be compromised.

For bank staff and executives

Treat any payment instruction arriving via chat as unverified until confirmed on a second channel — a call to a known number. This defeats the fraud even if the malware succeeds.

For bank security teams

• Block the indicators below and deploy the behavioural rules.
• Disable or monitor ISO/.img auto-mount and execution from mounted volumes where feasible.
• Brief executives and finance teams specifically — they are the named targets.
• Report activity to CERT-In ([email protected]).

Indicators of compromise

Defanged. Campaign infrastructure rotates rapidly — re-validate before operational use.

Files (SHA-256)

C2 domains

IPs — ASN 14956 RouterHosting LLC

Network & host artifacts

Filename patterns: <X>_INV_<date>_v<NN>.img|.iso, <X>_pcalua_<date>.img, <X>_vlc_<date>.img, Statement of Account*, Bank Statement*.vbs, E-statement*, Reconciliation Confirmation Letter.img.