Eric.freyssinet: 1 revision imported

2015-02-07T14:23:33Z

1 revision imported

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf symantec.com (pdf)
|Author=Nicolas Falliere,
|NomRevue=Symantec Security Response
|Date=
|Editor=Symantec
|Year=2001
|ISBN=
|Page=
|Abstract=W32.Qakbot is a worm that has been seen spreading through network
shares, removable drives, and infected webpages, and infecting computers since mid-2009. Its primary purpose is to steal online banking
account information from compromised computers. The malware controllers may use the stolen information to access client accounts within
various financial service websites with the intent of moving currency to
accounts from which they can withdraw funds. It employs a classic keylogger, but is unique in that it also steals active session authentication
tokens and could piggy back on the existing online banking sessions.
This information could be used for malicious purposes.
In-field telemetry shows that the malware authors have gotten more
and more aggressive and successful in their ability to infect the common client. Even though we don’t have evidence to show the increase in
monetary gain made by malware controllers, we do believe the in-field
propagation is directly proportional to the loss incurred by banks and
end clients.
There are several information stealing Trojans found in cyberspace today. What makes Qakbot stand apart from most of the others is sophistication and continuous evolution. The purpose of this white paper is to
provide an insight into the worm’s capabilities.
|Botnet=Akbot,
|Malware=Akbot_(bot),
|CCProtocol=,
|Operation=,
|Keyword=,
}}

W32.Qakbot in detail - Revision history

Eric.freyssinet: 1 revision imported