Banking Trojan masquerading as Chrome installer
Posted on 16.05.2012
Brazilian and Peruvian users looking to install Google's Chrome browser are in grave danger of downloading information-stealing malware instead.

"We recently found some suspicious looking URLs which suggest that a malicious file named ChromeSetup.exe is hosted in domains like Facebook and Google," Trend Micro researchers warn.

Most of the domains in question seem to be tied to Brazil, as they misuse its country code top-level domain (.br), but all of them redirect to two other IP addresses from which they download the malicious file, which is actually a multi-component banking Trojan.

Once downloaded and run, the malware contacts a C&C server to which it sends information about the the IP address and OS of the infected machine, and from which it downloads a configuration file that is used to redirect users to realistically spoofed banking sites when they are trying to visit the legitimate ones:

Users can notice the switch only if they pay attention to the real URL of the site and if the spot the "_" before the name in the window title.

Another component of the Trojan manages to uninstall GbPlugin, a software used to protect Brazilian bank customers when they perform online banking transactions. It's interesting to note that the deinstallation is performed by a legitimate tool originally created for uninstalling malicious software.

By analyzing the C&C panel before the server became inaccessible, they researchers discovered that some 3000 machines have been infected with the banking Trojan in a time span of mere three hours.

Further analysis showed that different variants of the same Trojan were pushed out in the wild, and that the cyber crooks behind this scheme have been at it for quite a while.

"While we may have a complete picture of this particular attack, the one missing piece now is the same thing that made us notice this malware from the millions of data that we have from our threat intelligence Ė how it is able to redirect user accesses from normal websites like Facebook or Google to its malicious IP to download malware," the researchers concluded, and promised to continue their investigation into the matter.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Feb 9th