Probing the Gozi-Prinimalka campaign

From Botnets.fr
Jump to: navigation, search

(Publication) Link to the old Wiki page : [1] / Google search: [2]

Probing the Gozi-Prinimalka campaign
Botnet Gozi, Prinimalka
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date 2012 / 2012-11-13
Editor/Conference Trend Micro
Link http://blog.trendmicro.com/trendlabs-security-intelligence/probing-the-gozi-prinimalka-malware/ (Archive copy)
Author Ivan Macalintal
Type

Abstract

To find out more about this Gozi-Prinimalka malware, we acquired samples and analyzed them to check the malware’s routines and notable behaviors. The first sample, detected as BKDR_URSNIF.B, monitors users’ browsing activities. It gathers information if it contains specific strings related to banking and financial institutions such as PayPal, Wells Fargo, and Wachovia among others.

Bibtex

 @misc{Macalintal2012BFR1202,
   editor = {Trend Micro},
   author = {Ivan Macalintal},
   title = {Probing the Gozi-Prinimalka campaign},
   date = {13},
   month = Nov,
   year = {2012},
   howpublished = {\url{http://blog.trendmicro.com/trendlabs-security-intelligence/probing-the-gozi-prinimalka-malware/}},
 }