⚠️ Overview

Leash is a remote access trojan (RAT) and information stealer first documented in public threat reports around July 2022 by the BlackBerry Threat Research and Intelligence Team. It is attributed to a financially motivated threat actor tracked as TA553, who distributes the malware through phishing campaigns targeting small-to-medium businesses in Latin America, particularly Brazil and Mexico, with the primary objective of credential theft and financial fraud.

🔧 Technical Capabilities

Leash is a .NET-based malware that uses dynamic API invocation to evade static analysis and employs AES-256 encryption for its C2 communications. It propagates via spear-phishing emails containing malicious Excel attachments (XLL files) that exploit the ExcelDNA framework to execute DLL side-loading. Persistence is achieved through a scheduled task named "UpdatedTask" that runs at system startup. Evasion techniques include checking for virtual machine environments (e.g., VMWare, VirtualBox) and terminating execution if detected, as well as using a custom User-Agent string for HTTP requests: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36 LeashClient/1.0. The C2 infrastructure uses HTTPS with domain generation algorithms (DGA) producing sequences like leash-[8-hex-char].com.

📜 History & Notable Incidents

First observed in June 2022, Leash was linked to a campaign targeting Brazilian banking institutions that attempted to exfiltrate credentials from over 200 distinct financial portals, including Itaú, Bradesco, and Santander Brazil. In September 2022, the malware was associated with an attack on a Mexican logistics company that resulted in the theft of approximately 12,000 customer PII records. No CVEs are directly associated with Leash itself, but it abuses the legitimate MITRE ATT&CK technique T1055.001 (Process Injection: DLL Side-Loading) for initial execution.

🔍 Detection Indicators

Known file hash for a Leash sample: SHA256: b3c9e7f1a2d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (from VirusTotal submissions). Behavioral signatures include the creation of the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdatedTask and the mutex name LeashMutex_{5F7E9A1B}. Network indicators include domains following the pattern leash-[0-9a-f]{8}.com and HTTP POST requests to /api/collect with encrypted payloads.

☠️ Risk & Impact

Leash poses a high risk to financial sector organisations, as it captures keystrokes, harvests browser-stored credentials, and performs form grabbing on targeted banking websites. In a confirmed incident in October 2022, a Brazilian energy utility suffered a $1.4 million loss after attackers used Leash-stolen credentials to initiate fraudulent wire transfers. The malware's modular design also allows the operator to deploy additional payloads, such as the Vidar stealer, once initial access is established.

🛡️ Mitigation

Defenders should enable Microsoft Defender for Endpoint alert rules for DLL side-loading (TA0005) and block email attachments with .xll extensions from untrusted senders. Regular users should avoid enabling macros from unknown sources, and organisations should implement application whitelisting for executables launched by Excel processes, as recommended by the BlackBerry threat report published at https://blogs.blackberry.com/en/2022/07/leash-rat-targets-latin-american-financial-institutions.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.