View source for Win32/Spy.Ranbyus modifying Java code in RBS Ukraine systems

{{Publication
|Link=http://blog.eset.com/2012/12/19/win32spy-ranbyus-modifying-java-code-in-rbs blog.eset.com
|Author=Aleksandr Matrosov
|NomRevue=ESET Threat Blog
|Date=2012-12-19
|Editor=ESET
|Year=2012
|Botnet=Ranbyus
|Abstract=I’ve already mentioned the Win32/Spy.Ranbyus family in my previous blog post about smartcard monitoring in modern banking malware (Smartcard vulnerabilities in modern banking malware). It displays really interesting functionality because it shows how it is possible to bypass payment transaction signing/authentication with smartcard devices. We have been tracking the latest modification to this malware family and the trojan Ranbyus has started to modify java code in one of the most popular remote banking systems (RBS) in the Ukraine, BIFIT's iBank 2. ESET Virus Radar statistics show that Ukraine is the region most affected ever by Ranbyus infection.
}}