Huis » Nieuws » Trojan Varenyky spionnen op pornosites gebruikers

Trojan Varenyky spionnen op pornosites gebruikers

ESET experts warned that since May 2019, Franse gebruikers hebben aangevallen door Windows malware Varenyky, die niet alleen stuurt spam van besmette machines, maar registreert ook alles wat er gebeurt op de slachtoffers’ computers als ze op bezoek pornosites - Varenyky spionnen op pornosites gebruikers.

Varenyky spreads according to the classical schemethrough malicious emails that supposedly contain some important invoices. Eigenlijk, natuurlijk, there is no accounts in investments, and malware penetrates usersmachines in this way.

The main goal of Varenyky is to send spam that targets French users (mainly aimed at the clients of the Internet provider Orange SA).

“This spambot is not very advanced, but the context and story around it make it interesting. Many functions have been added and then quickly removed across many different versions in a short period of time (two months). This shows that the operators are actively working on their botnet and are inclined to experiment with new features that could bring a better monetization of their work”, — report in ESET.

Als regel, malware spread by links to suspicious promotions that supposedly allow winning expensive smartphones. To participate in such adrawthe user, natuurlijk, needs to enter a lot of personal data, including name, address, city, email address, phone number and bank card information.

Echter, in late July, Varenyky began to send out other messages related tosextortion.

Notitie: The term sextortion derived from the words “sex” and “extortion” and is used to indicate such activity.

In such messages, Varenyky operators claim that they infected userscomputers while visiting adult sites, recorded everything on video and now demand a ransom. belangwekkend, these statements are only partially false.

LEZEN  Virus Check.exe Trojan coming back

The fact is that Varenyky, natuurlijk, does not follow random recipients of spam emails, but really has a hidden function that looks through the window titles and looks for words related to pornography, bijvoorbeeld, the Frenchsexe”. Dan, using the FFmpeg bibliotheek, the malware records everything that happens on the user’s screen. Dat is, this function should work when a user visits adult sites. The video recorded in this way is transmitted to the control server of the malware, located on the Tor network.

Message of Varenyki Trojan
Message of Varenyki Trojan

What then the malware operators do with the received video is unknown. ESET analysts note that as Varenyky is under development, malware now has new features, and old ones are deleted. Vanwege dit, it is difficult to understand why Varenyky’s operators collect such videos (allegedly virus writers can do this for fun or simply of curiosity).

Lees ook: The new version of the banking Trojan TrickBot “kicks off” Windows Defender

It is also possible that in the future, attackers plan to blackmail Varenyky victims with recorded videos, extorting money from them. The fact is that Varenyky operators can easily associate recordings with the real identities of users. Om dit te doen, the malware has another hidden function that extracts usernames and passwords from browsers and email clients. All this data is also transmitted to the management server.

And if Varenyky developers ever decide to ransom money from users, they will know exactly where and to whom to send a compromising record about a visit to a porn site.

[Totaal: 0    Gemiddelde: 0/5]

Over Trojan Killer

Carry Trojan Killer Portable op je memory stick. Zorg ervoor dat u in staat om uw pc te weerstaan ​​elke cyberdreigingen overal mee naar toe bent.

Controleer ook

Cudac.exe – Virus Bestanden verwijderen

Een gloednieuw, really harmful cryptocurrency miner virus has been discovered by safety and security researchers. …

Trojan Casbaneiro gebruikt YouTube

Casbaneiro banking Trojan gebruikt YouTube om cryptogeld stelen

Eset studied the new Casbaneiro family of banking Trojans. A malicious program hunted for cryptocurrency

Laat een antwoord achter