Banking Malware Uses PAC File

This report documents a malware sample that modifies the Windows registry Internet Settings AutoConfigURL to point to an attacker-controlled PAC file (http://dns.configdeskwork.com:8099/workwindows.pac). The PAC causes targeted banking and other traffic (including Brazilian sites and American Express) to be proxied to 208.64.66.170, enabling credential theft; the report includes the PAC content, registry key used, FQDN and resolved IP as IOCs.