Trojan-Banker.Win32.Qadars

Parent class: TrojWare

Trojans are malicious programs that perform actions which are not authorized by the user: they delete, block, modify or copy data, and they disrupt the performance of computers or computer networks. Unlike viruses and worms, the threats that fall into this category are unable to make copies of themselves or self-replicate. Trojans are classified according to the type of action they perform on an infected computer.

Class: Trojan-Banker

Trojan-Banker programs are designed to steal user account data relating to online banking systems, e-payment systems and plastic card systems. The data is then transmitted to the malicious user controlling the Trojan. Email, FTP, the web (including data in a request), or other methods may be used to transit the stolen data.

Read more

Platform: Win32

Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.

Description

Malware of this family is distributed by cybercriminals using the Nuclear Exploit Kit and in spam messages. An exploit kit is used to look for exploits in programs installed on client computers. When malware of this family is run on an infected computer, a downloader starts. The downloader determines whether the operating system is 32-bit or 64-bit and then downloads the appropriate version of the main module of the malware. The main module contacts a command-and-control server controlled by cybercriminals and downloads additional modules for performing various malicious actions. The malware family supports the following add-on modules: • browser injector • keylogger • tor • vnc • backconnect The main module also downloads configuration files for each add-on module. For example, for targeting a browser, the malware downloads the code that it will insert into the web pages opened in the browser. The malware encrypts the connection between the infected computer and the command-and-control server controlled by the cybercriminal. A pair of encryption algorithms (RSA + AES) is used for data transfer. The data transfer protocol is based on Concise Binary Object Representation (CBOR). In addition, the Trojan-Banker.Win32.Qadars family uses the Domain Generation Algorithm (DGA) to conceal the IP address of the command-and-control server.

Top 10 countries with most attacked users (% of total attacks)

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com