Showing posts with label Spyware Threats. Show all posts
Showing posts with label Spyware Threats. Show all posts

PandaLabs Discovers Trojan in Fake UPS Messages

Friday, July 18, 2008 by Mzer0 ,

PandaLabs, company that specializes in providing security software solutions, has recently announced that a spam message containing malware has surfaced. The message appears to be sent by parcel delivery company UPS, but in fact it is sent by someone who is maliciously trying to infect your system with a Trojan which PandaLabs named Agent.JEN


Users are advised to be cautious if they receive a message entitled "UPS packet N3621583925" for example. The message claims that a parcel could not be delivered because there is an issue with the recipient's address. In order to recover the parcel which the message says it was sent out on the 1st of July, you are advised to download a .zip file and then print out an invoice. Except that the .zip does not contain any invoices, it contains Agent.JEN.Trojan.

Once the Trojan infects a system, it replaces Userinit.exe with userini.exe. You will not notice any changes in your machine's functionality, except that the Userinit.exe file that runs the system interface, explorer.exe and other processes has been swapped with malware.

Luis Corrons, Technical Director of PandaLabs comments: "All this effort not to be noticed is in consonance with the current malware dynamic: cyber-crooks are no longer interested in fame or notoriety; they are out to get financial returns as silently as possible. We had seen cyber-crooks use erotic pictures, Christmas or romantic cards, fake movie trailers, etc. as bait to make users run infected files. However, it is not usual to see baits like this one. This clearly indicates that cyber-crooks are trying to use baits that do not raise suspicion to spread their creations."

The researchers at PandLabs have discovered that the Trojan connects to a domain in Russia, which is already known to be used by several banker Trojans. A download query is then forwarded to a German domain, requesting the files Rootkit/Agent.JEP and Adware/AntivirusXP2008. These files considerably increase the risk of your system becoming infected.

UPS is currently aware of the situation and has decided to inform its customers via e-mail.

[Source: softpedia]

0 comments

 

FaceTime Warns about Latest Sysda Phishing Threat

Monday, July 14, 2008 by Mzer0 ,

According to Chris Mannon, senior threat researcher with FaceTime Security Labs, the latest phishing security threat has been identified as Sysda. Although at this point only Chinese users should be worried about it, FaceTime expects it to jump over to the US, and other parts of the world, in the near future. Sysda is a Trojan that attempts to steal the passwords used by people when logging into various
Chinese web pages.

Chris Mannon comments on the FaceTime spyware blog: "This is not really a threat to most businesses in the US, but judging from the malware trend coming from China and spreading to the rest of the world, I'd say its only a matter of time before we start seeing the same method of theft. The name of this new threat has been named [sic] Sysda. All it really needs is to hook into iexplore.exe to steal your user credentials."

After infecting a user's machine, the Trojan simply goes dormant until certain user actions trigger it, such as browsing through a certain web page. Usually, these are pages that require you to insert your username and password. Sysda grabs this information and posts it on a remote site to which the hacker has access to.

"Whether this is simply a new way to phish for information, or something more sinister along the lines of fraud is still unclear at this point. I'll let you know what I found out," says Chris Mannon, whose job with FaceTime Security Labs is to keep track of malware and virus trends, investigate the most recent scam and hijack attempts, as well as to become familiar with the latest methods employed by hackers and attackers.

Sysda is the latest Trajan discovered by FaceTime Security Labs
Comments: Sysda is the latest Trajan discovered by FaceTime Security Labs
Credits: Silicon Republic

FaceTime Security Labs specializes in providing security solutions meant to protect applications such as instant messaging programs, Skype, web conference programs, and P2P file sharing. All of these software programs are known as greynet applications.

[Source: softpedia]

0 comments