BitDefender releases free removal tool for Carberp Trojan
November 2010
IT in Manufacturing
Standalone utility available for free download on MalwareCity.com to protect against growing threat from potent banking Trojan.
BitDefender has announced a free removal tool targeting the Trojan.Downloader.Carberp.A. Building on the technologies implemented in Zeus and Brazilian Bankers, Trojan.Downloader.Carberp.A has rapidly obtained its place among a rather exclusive club of banking Trojans. It is designed to intercept, manipulate and steal confidential information a user might send or receive over the internet.
Trojan.Downloader.Carberp.A snatches details from websites that require log-in sessions over a SSL connection such as online banking services and e-mail providers. Apart from keeping an eye on every service that is important enough to force SSL authentication, Trojan.Downloader.Carberp.A is also instructed to monitor a list of websites containing several e-banking portals.
“Once executed on a computer, Trojan.Downloader.Carberp.A creates a couple of temporary files in the %temp% folder, then copies itself to the Windows Startup folder in order to self implement after every boot or restart,” said Catalin Cosoi, head of the BitDefender Online Threats Lab. “This approach may seem basic compared to other families of malware that add startup entries to the Registry, however, it is this depreciation that allows Trojan.Downloader.Carberp.A to execute itself on newer operating systems, or run on users’ accounts that do not have administrative privileges.”
Right after infection, the downloader connects to a C&C server, from which it will download an encrypted configuration file, along with additional fire-power such as plug-ins. This allows Trojan.Downloader.Carberp.A to intercept Internet traffic and to kill whatever antivirus it may find on the recently infected computer. It then sends the C&C server a unique ID and uploads a list of currently running processes via a GET request.
After it has successfully copied itself in the startup folder as either syscron.exe or chkntfs.exe, Trojan.Downloader.Carberp.A hides its presence by using function hooks in ntdll.dll in order to intercept any calls to NtQueryDirectoryFile and ZwQueryDirectoryFile. This means the user cannot see its files when using Windows Explorer or the command-line dir query.
Cosoi continues, “Every time a user logs in using SSL-based authentication to gain access to online banking, e-mail and social network accounts Trojan.Downloader.Carberp.A steals their details, before they are encrypted, and sends them to its C&C server over HTTP. By the time the log in request reaches the bank the credentials will already have fallen into the hands of the attackers.”
Trojan.Downloader.Carberp.A also targets certain banks in Germany, Denmark, the Netherlands, America and Israel following precise instructions that it receives from the C&C server along with configuration instructions. This sophisticated approach provides a lucrative financial tool designed to steal money from online service customers and SMBs. Trojan.Downloader.Carberp.A is also able to install without administrator privileges, attack systems that run the latest versions of OSs and doesn’t make any changes in the Registry or in critical areas of the operating system.
BitDefender customers have been protected since day zero via generic packer routines already included in the signature database. For those not protected by a BitDefender product, a free removal tool can be downloaded from the Downloads section of MalwareCity.com
For a full list of BitDefender 2011 features and benefits by product, visit www.bitdefender.com/world
For more information contact Alina Anton, senior PR & marketing coordinator, EMEA & APAC Business Unit, BitDefender, +40 212 063 470, [email protected], www.bitdefender.com
Further reading:
Five data centre trends to watch in 2025
IT in Manufacturing
Any innovation that comes out in 2025 – whether it’s flying cars, highly advanced AI or a breakthrough medical treatment – will be built on the back of an equally innovative IT foundation driven by data. Data that needs to be stored, managed and made accessible in the data centre, in the cloud or at the edge. Is it too much of a stretch to say the future of humankind is dependent on data storage? We don’t think so.
Read more...
Recovering from a cyberattack
IT in Manufacturing
While many organisations have invested heavily in frontline defence tools to try to keep out bad actors, they have spent far less time and money preparing for what happens when the criminals eventually get in. And they will get in.
Read more...
The value of proactive maintenance management
Schneider Electric South Africa
IT in Manufacturing
Maintenance has come a long way from the days when we waited for things to break, and thanks to the ever-increasing capabilities of technology, predictive maintenance has become a viable solution for keeping equipment running smoothly and efficiently around the world.
Read more...
Significant decarbonisation can be achieved in the mining industry
ABB South Africa
IT in Manufacturing
ABB has released a global report titled ‘Mining’s Moment’, which highlights the progress being made by the mining industry to make operations more sustainable.
Read more...
Pinpointing pipeline occurrences in seconds, not hours
Schneider Electric South Africa
IT in Manufacturing
At any given moment, thousands of kilometres of critical assets flow through pipelines that cross veld, mountainous areas, dense forests, and even busy streets. Surprisingly, many of these pipelines operate either unmonitored or with scant oversight, leading to missed opportunities for operational continuity and efficiency.
Read more...
Next-generation AI-enhanced electronic systems design software
Siemens South Africa
IT in Manufacturing
Siemens Digital Industries Software has launched the latest advancement in its electronic systems design portfolio. The next-generation release takes an integrated and multidisciplinary approach, bringing a unified user experience that delivers cloud connectivity and AI capabilities to push the boundaries of innovation in electronic systems design.
Read more...
Spatial computing and AI – where no man has sustainably gone before
Schneider Electric South Africa
IT in Manufacturing
Some will argue that we now live in a sci-fi world where we dream of electric sheep, and today’s technology – unlike HAL – can provide us with the answers we seek. To the realist it might seem a bit implausible, but when you start using terms like ‘spatial computing realises sustainable AI’ it doesn’t seem that far-fetched.
Read more...
Safeguarding DCS today and tomorrow
Schneider Electric South Africa
IT in Manufacturing
Today’s distributed control systems (DCS) are highly intelligent, converging OT and IT in a centralised manner that allows for simplified management and coordination of operations. It is technology evolution at its finest, but with a caveat, cybersecurity challenges.
Read more...
Quantum computing is not as futuristic as it sounds
IT in Manufacturing
The first quantum computer was created almost three decades ago. While its applications are still unknown to many, this advanced field combines computer science, physics and mathematics to deliver solutions the world has been trying to find for aeons – and those it doesn’t yet know it needs.
Read more...
Transform field data into actionable business data
IT in Manufacturing
As part of its ongoing commitment to enhancing industry connectivity, Teledyne Gas & Flame Detection is making its new and proprietary Teledyne GDCloud available with the company´s GS700, GS500 and Shipsurveyor portable gas leak detectors, and also its PS200 portable four-gas monitor for personal safety and confined-space applications.
Read more...
printer friendly version