Playing cops & robbers with banks & browsers

(Publication) Google search: [1]

Playing cops & robbers with banks & browsers
Botnet	ZeuS
Malware	Zbot, Neloweg
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2012 / 27 Feb 2012
Editor/Conference	Symantec
Link	http://www.symantec.com/connect/blogs/playing-cops-robbers-banks-browsers www.symantec.com (www.symantec.com Archive copy)
Author	Fred Gutierrez
Type

Abstract

“ We are currently tracking a banking Trojan called Trojan.Neloweg. Looking at early infection numbers, we noticed that a small number of users were compromised in the UK and the Netherlands.

Digging into the threat, we saw that the login credentials of these users (including banking credentials) may have been stolen. A partial list of affected bank pages can be seen below. In order to see where other infections were occurring, we took a more global look at the infection numbers. Apparently the threat has been localized to Europe. Trojan.Neloweg operates similar to another banking Trojan known as ZeuS. Like ZeuS, Trojan.Neloweg can detect which site it is on and add custom JavaScript. But while ZeuS uses an included configuration file, Trojan.Neloweg stores this on a malicious webserver. Once a particular banking page has been matched, Trojan.Neloweg will cover part of the page in white, using a hidden DIV tag, and execute custom JavaScript located on the malicious server. We are currently monitoring the threat to see what changes it is making to the banking pages that a compromised users visits. [...] As can be seen from the screenshot above, the browser (Firefox in this instance) can now function like a bot and accept commands.

Bibtex

 @misc{2012BFR905,
   editor = {Symantec},
   author = {Fred Gutierrez},
   title = {Playing cops & robbers with banks & browsers},
   date = {27},
   month = Feb,
   year = {2012},
   howpublished = {\url{http://www.symantec.com/connect/blogs/playing-cops-robbers-banks-browsers www.symantec.com}},
 }