The activity of the new version of the Ramnit worm on social networks is marked.
Seculert analysts have published their observations on the activity of the new version of the Ramnit worm, which has already been repeatedly seen as a tool for committing fraud related to financial transactions on the Internet.
For the first time, Ramnit activity was discovered by experts back in 2010, when, infecting Windows executable files, when launched on the victim’s computer, it became possible to spread, infecting HTML, DLL, DOC, XLS and SCR files. The control servers of the malware, as defined by Symantec, are located in Germany, and a characteristic feature of Ramnit’s work was that it connected to its “host” using HTTPS.
In May 2011, one of the hacker forums published the source code of the infamous Zeus Trojan, which, in all likelihood, the author (s) Ramnit did not fail to take advantage of. Researches of several anti-virus companies at once showed that the “malware” acquired new functionality inherited from Zeus, namely the ability to integrate into the browser and change the content of the target web page.
As a result, being able to bypass the two-factor authentication mechanism and transaction signing systems, Ramnet from September to December of last year infected about 800,000 computers, most of which were regular users. Now, the worm has received new functionality that helps it spread thanks to the widespread popularity of social networks: Ramnit is able to steal logins and passwords to Facebook, thus compromising a user account that his friends receive a malicious link, which will further spread the worm.
')
Seculert experts have already discovered the fact of theft of about 45,000 passwords to the social network, mainly in England and France, which, of course, on the scale of the network itself looks insignificant. Nevertheless, the very fact of a new way of spreading a dangerous worm threatening users with financial losses makes us think once again about our security, especially in such a “densely populated” place as the most popular social network in the world.
[ Source ]
For the first time, Ramnit activity was discovered by experts back in 2010, when, infecting Windows executable files, when launched on the victim’s computer, it became possible to spread, infecting HTML, DLL, DOC, XLS and SCR files. The control servers of the malware, as defined by Symantec, are located in Germany, and a characteristic feature of Ramnit’s work was that it connected to its “host” using HTTPS.
In May 2011, one of the hacker forums published the source code of the infamous Zeus Trojan, which, in all likelihood, the author (s) Ramnit did not fail to take advantage of. Researches of several anti-virus companies at once showed that the “malware” acquired new functionality inherited from Zeus, namely the ability to integrate into the browser and change the content of the target web page.
As a result, being able to bypass the two-factor authentication mechanism and transaction signing systems, Ramnet from September to December of last year infected about 800,000 computers, most of which were regular users. Now, the worm has received new functionality that helps it spread thanks to the widespread popularity of social networks: Ramnit is able to steal logins and passwords to Facebook, thus compromising a user account that his friends receive a malicious link, which will further spread the worm.
')
Seculert experts have already discovered the fact of theft of about 45,000 passwords to the social network, mainly in England and France, which, of course, on the scale of the network itself looks insignificant. Nevertheless, the very fact of a new way of spreading a dangerous worm threatening users with financial losses makes us think once again about our security, especially in such a “densely populated” place as the most popular social network in the world.
[ Source ]
Source: https://habr.com/ru/post/135757/
All Articles