https://www.botnets.fr/index.php?action=history&feed=atom&title=Win32%2FSpy.Ranbyus_modifying_Java_code_in_RBS_Ukraine_systemsWin32/Spy.Ranbyus modifying Java code in RBS Ukraine systems - Revision history2026-10-24T04:20:44ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=Win32/Spy.Ranbyus_modifying_Java_code_in_RBS_Ukraine_systems&diff=2750&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:29:17Z<p>1 revision imported</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:29, 7 February 2015</td>
</tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr>
<!-- diff cache key wiki:diff:1.41:old-2749:rev-2750 -->
</table>Eric.freyssinethttps://www.botnets.fr/index.php?title=Win32/Spy.Ranbyus_modifying_Java_code_in_RBS_Ukraine_systems&diff=2749&oldid=prevEric.freyssinet at 20:31, 19 December 20122012-12-19T20:31:28Z<p></p>
<p><b>New page</b></p><div>{{Publication<br />
|Link=http://blog.eset.com/2012/12/19/win32spy-ranbyus-modifying-java-code-in-rbs blog.eset.com<br />
|Author=Aleksandr Matrosov<br />
|NomRevue=ESET Threat Blog<br />
|Date=2012-12-19<br />
|Editor=ESET<br />
|Year=2012<br />
|Botnet=Ranbyus<br />
|Abstract=I’ve already mentioned the Win32/Spy.Ranbyus family in my previous blog post about smartcard monitoring in modern banking malware (Smartcard vulnerabilities in modern banking malware). It displays really interesting functionality because it shows how it is possible to bypass payment transaction signing/authentication with smartcard devices. We have been tracking the latest modification to this malware family and the trojan Ranbyus has started to modify java code in one of the most popular remote banking systems (RBS) in the Ukraine, BIFIT's iBank 2. ESET Virus Radar statistics show that Ukraine is the region most affected ever by Ranbyus infection.<br />
}}</div>Eric.freyssinet