Researchers have discovered a banking trojan making waves in Brazil with an array of tricks up its sleeve, including using an unusual command and control (C&C) server. Researchers at IBM X-Force research on Tuesday revealed that attackers are using the malware dubbed MnuBot mainly in Brazil to perform illegal transactions on victims open banking sessions. The remote access trojan is unique in that it constantly queries the Microsoft SQL Database server for commands to be performed, giving attackers better dynamic configurations and anti-research capabilities.
Source: https://threatpost.com/brazilian-banking-trojan-communicates-via-microsoft-sql-server/132325/