Hello, cyberstalkers! Hello, random carders. Today's computers and smartphones store real money. Well, let them not be stored, but access to them is quite guaranteed! Therefore, we are now seeing that the good old methods, such as blackmail, extortion and fraud, are showing themselves at a new technological level. Meanwhile, we have a big review of modern malware that squeezes money from users.
Go:
As you know, the days of ideological virus writers have sunk into oblivion, capitalism has arrived in individual countries, and malicious code is now written almost exclusively on a commercial basis. Of course, the ideological people remained, but they are more likely suppliers of interesting chips and ways to bypass the security mechanisms of the Windows operating system, and other, more cunning people implement these developments in their malicious creations.
Harmfulness can be, so to speak, direct and indirect. Some Trojans focus on monetizing the hardware resources and computing power of end users. These include: organizing proxy and DDoS attacks, sending spam, bitcoin mining, cheating site visits (black SEO), clicking on advertising banners (click fraud). A prominent representative of the group is ZeroAccess. These malicious programs do not cause direct damage to the user. The only problems caused by such malware are computer slowdowns and crashes. And in modern conditions, when the computing power has become quite large, the user may not even suspect that his computer has become part of a botnet.
Other malware representatives cause significant harm to the user, including financial damage. This category includes: ransomware, which includes two varieties — lockers and encoders, although in recent years the boundaries between them are blurred; the fake anti-viruses that require the coin for the setting (it takes place in category "fraud"); malware designed to steal user credentials, including the systems of remote banking services (RBS), the "classic" members — Zeus and his followers — SpyEye and Citadel.
As you can see, shadow runner, law enforcement interest in these malware groups will vary. There is little interest in the first group, and a lot of interest in the second, since in the first case the user will move the axis at most, and in the second case they will run to the police with a report. There is an opinion that in this way some Trojan makers try to draw less attention to themselves and their crafts.
Further, some representatives of the second group will be considered.
There is a third group — spyware, both broad (spyware) and special (APT) orientation. This topic is now actively supported by all antivirus vendors, but this usually does not apply to ordinary users. In this case, monetization is achieved by the fact that such Trojans extract confidential information, for which customers are willing to pay a tidy sum.
It is alarming that many European firms (Gamma Group, Hacking Team) openly offer services for the mass installation of so-called "state" Trojans, which on paper are intended for law enforcement officers and special services, but in fact can be used by anyone who has the appropriate financial means. According to McAfee, the developers of the Citadel Trojan, which has already become a "classic", have now "gone into the shadows", and they began to introduce spy modules, and, apparently, also began to offer their services to government and commercial organizations engaged in obtaining information on the Internet.
That's all for now, cyberborn. See the continuation of this article on the channel a little later. Stay tuned. Then it will be even more interesting.
Continuation of the big Malware FAQa. Who hasn't read it yet - read the beginning on the channel above. Something that will be useful for us to earn money (for some people, for sure)
Go:
Winlockers are such winlockers
They first appeared in late 2007. They were widely distributed in the winter of 2009-2010, according to some reports, millions of computers were infected, mainly among Runet users. In the simplest case, after loading the OS or even before it (there were also such instances), a beautiful window was shown with the requirement to send a certain amount to attackers in any way in exchange for an unlock code. General advice from employees of antivirus companies — do not pay anything! The time of" honest " winlockers, which contain the functionality of auto-deletion by code, has long passed, and now this niche of cybercrime has been chosen by kids with exorbitant ambitions.
Numerous forums were filled with posts with generators and source codes of lockers. Here, for example, is a piece of art that you can't look at without laughing-Winlock by DragonGang. The size of the masterpiece is amazing - as much as seven meters! Written in the Delphi 7 environment. The unlock code 141989081989 is stored in the executable file in clear text. There is an opinion that the text was deliberately written in the style of the unforgettable Jamshut and the author was promoted to the entire Internet due to this (including in this article).
B]In the meantime, schoolchildren are hoeing the Slavic audience, "merchants" from the Trojan world are flooding abroad with winlockers.[/B] There is even a special term — multilocker. This is a locker that initially does not contain any resources — inscriptions, images, etc., but downloads them from the command center of intruders, while the downloaded content depends on the country, which is determined by the IP address. The main topic of multilokers is accusing the user of viewing pornographic materials with the participation of minors, you know yourself-this is strictly dealt with abroad. At the same time, as evidence, the victim is shown the pictures allegedly viewed by her, as well as the names, dates of birth and place of residence of the minors depicted in the photo. Recent developments have taken into account the mass distribution of laptops, which almost always have a built-in webcam: the user is filmed and then shown a photo, which further enhances the effect of the presence of Big Brother, that is, surveillance by the FBI or some other law enforcement organization.
Or here's a trick-scanning the history of visited sites in the browser. It's no secret that most of the world's male population periodically, ahem, admires naked women from the Internet. Therefore, when the user has a splash screen about the fine with the symbols of Interpol and a list of visited "hot spots" on the Internet, he does not have even a shadow of doubt that this is true.
Thus, the winlocker market was segmented: on the one hand, there are scriptkids with kulhatskers, on the other - "veterans" of Trojan writing, writing multilockers in the manner of botnets with their own control centers.
One of the most complex and highly professionally written Gapz bootkits It also has quite a lot of malicious locker modules in its arsenal. A component with this functionality checks the location of the infected computer by its IP address, and if the victim lives in Western Europe or America, the system is blocked and a window is displayed with a request to transfer a certain amount to the specified account. What distinguishes this locker is that it intercepts an image from a webcam connected to an infected computer and shows it in a window with a payment request (no wonder my camera is covered with electrical tape. I'm serious. — Editor's note).
A special feature is lockers that block access not to the operating system, but to any popular resources from the browser. In April, a flurry of requests from users about the inability to log in to the sites VKontakte, Odnoklassniki and Mail.ru. Instead of the corresponding Internet resources, the browser window displayed web pages with a message that the user's profile was blocked due to suspected hacking of the account, and a suggestion to enter their phone number. After entering the number in the SMS, a code is sent, which the user again must confirm via SMS. In fact, a certain amount of money is charged for sending this SMS. During the proceedings, it was established that all this is the tricks of malware, replacing the system file. rpcss.dll to your malicious code.
ESET defines this threat as Win32 / Patched. IB. The malware spoofs DNS queries, returning the IP addresses of servers controlled by attackers that contain web pages that mimic the target resource — vk.com, odnoklassniki.ru, mail.ru. The correct URL is displayed in the browser's address bar. Correct treatment method for all numerous Win32/Patched modifications.Most antivirus products don't have IB at the time of writing. For manual treatment, you need to take a clean one rpcss.dll, boot from the LiveCD and replace the malicious library with it. Original version rpcss.dll it must match the version, bit depth, and installed service packs of the installed Windows (Patched.IB works successfully in both XP and Seven, including x64).
Other threats of this type include the appearance of another modification of the Mayachok Trojan family. According to Dr. Web antivirus analysts, Trojan.Mayachok. 18607 is a completely independent version written "based on motives". As an example of imitation, the logic of the Mayachok Trojan was taken.1, which was widely distributed in the second half of 2011. The Trojan.Mayachok version is currently in use.2, which has bootkit functions. A characteristic feature of the Trojan.Mayachok family is the use of web-based injections.
We are enlightened, running in the shadows. And all those who are just starting on this difficult, but very exciting and profitable path. Continuation of this article on the channel a little later. Stay tuned.
