Win32/Gataka - or should we say Zutick?

(Publication) Google search: [1]

Win32/Gataka - or should we say Zutick?
Botnet	Gataka, Zutick, Tinba
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2012 / 2012-11-30
Editor/Conference	ESET
Link	http://www.welivesecurity.com/2012/11/30/win32gataka-or-should-we-say-zutick/ (Archive copy)
Author	Jean-Ian Boutin
Type

Abstract

“ Win32/Gataka is an information-stealing Trojan that has been previously discussed on this blog here and here. Recently, we came across a post from its author on an underground forum trying to sell his creation. The post contained a help file detailing the inner working of this threat. This blog post will highlight some of the most interesting part of this help file.

First off, it is interesting to note that the malware author is trying to sell the kit under the name Zutick. The asking price is $3,300 for both the control panel and builder. The documentation states that this Trojan works with all versions of Windows (32- and 64-bit) and its installation and operation doesn’t require administrative rights. It offers many plugins that facilitate the stealing of sensitive information, mainly through injection of arbitrary content into the compromised host browser. More information on the techniques used by this malware to intercept user content can be found here. The documentation states that all major browsers are supported: Internet Explorer, Firefox, Chrome, Opera and Safari.

Bibtex

 @misc{2012BFR1257,
   editor = {ESET},
   author = {Jean-Ian Boutin},
   title = {Win32/Gataka - or should we say Zutick?},
   date = {30},
   month = Nov,
   year = {2012},
   howpublished = {\url{http://www.welivesecurity.com/2012/11/30/win32gataka-or-should-we-say-zutick/}},
 }