Intruders ensinou Trojan Qbot se esconder em ramos de mensagens existente

banqueiro disseminador Qbot que é conhecida desde 2009 lançou outro e-mail-campanha, embora com algumas inovações.

Experts of command for special operations from American JASK company established that intruders are now masking malware messages by using existing electronic correspondence.

Hyperlink em download para o vírus Trojan para Windows inserido na resposta real no correio que já foi enviado pelo potencial vítima. According to JASK notification, email becomes inbuilt in existing branch of email correspondence. This allows lulling target’s vigilance and bypassing spam protection.

Greg Longo, JASK
Greg Longo, JASK

“This email was not blocked by an anti-spam gateway. It was a context-aware targeted response to an existing email thread,” wrote Greg Longo, senior threat analyst with JASK, in an email-based interview.

He also added that aim of such attacks is stealing confidential financial information, including back account credentials.

Infecting happens by the following algorithm. Fishing letter arrives with the link on Microsoft OneDrive file that delivers Microsoft Visual Basic Scripting Edition (VBScript) in compressed ZIP-archive. If this archive is open, attack starts the legitimate BITSAdmin Windows utility. este, Por sua vez, leads to activation of Wscript.exe that is another Windows utility that used for uploading Qbot «august.png» malware program from hackers’ server.

This trick applied now for delivery of long-living Trojan Qbot, também conhecido como QakBot e Pinkslipbot. Trojan that specializes on stealing data for access to bank accounts helps cybercriminals for more than 10 anos. In its popularity contributes ability to reproduce itself through removable shared media devices, and polymorphism – constant change of program code that allows bypassing antivirus protection.

Despite that Trojan virus Qbot is relatively well studied, specialists cannot block its spread since 2009. To avoid catching this virus, you should be careful while opening emails even from address that you trust.

Fonte: https://threatpost.com

Sobre Trojan Killer

Carry Trojan Killer portátil em seu memory stick. Certifique-se que você é capaz de ajudar o seu PC resistir a quaisquer ameaças cibernéticas onde quer que vá.

Além disso, verifique

MageCart na Cloud Platform Heroku

Os investigadores encontraram vários MageCart Web Skimmers Em Heroku Cloud Platform

Pesquisadores da Malwarebytes informou sobre encontrar vários skimmers MageCart web na plataforma Heroku nuvem …

Android Spyware CallerSpy

máscaras spyware CallerSpy como uma aplicação de chat Android

Trend Micro especialistas descobriram a CallerSpy malwares, que mascara como uma aplicação de chat Android, …

Deixar uma resposta