Vulnerabilities / Threats
7/1/2014
06:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Infamous Banking Malware Adds Email-Sending Feature

Cridex -- a.k.a. Feodo and Bugat -- now has a more streamlined and automated way of infecting victims and stealing their information.

A new version of an infamous banking worm comes with built-in stolen email account and server credentials for automatic email worm attacks to continue its spread.

The so-called Cridex data-stealing malware, a.k.a. Feodo and Bugat, now has a more streamlined and automated way of infecting victims, researchers at Seculert found. Once it's on a victim's machine, the new variant, dubbed Geodo by Seculert, downloads a second piece of malware that communicates with a command-and-control server. That second piece of malware is a worm that has 50,000 stolen SMTP email account credentials, including those of the associated SMTP servers.

Armed with those credentials, the malware sends out emails from legitimate accounts to other potential victims in an effort to continue its spread. Aviv Raff, CTO at Seculert, says this basically allows the infected bot to do the dirty work of infecting additional machines.

So far, the majority of the victims appear to be German speakers -- the emails are written mostly in German -- and 46% of the stolen credentials come from Germany.

"Usually we see additional malware they download from some other attacker that uses the same machine, or additional components that add some capabilities to the malware itself. This is the first time I've seen something that combines it," Raff says. "This downloads something that itself it sends to new victims. That's unique."

Seculert isn't sure from where the 50,000 stolen credentials were pilfered, but believes that the Cridex malware grabbed them. With the Geodo malware combination, a victim organization can also be at risk of its intellectual property being stolen, according to the firm.

Cridex traditionally had been known to spread via removable drives, but newer versions of the malware began arriving via Blackhole exploit kits, according to Trend Micro. There also are versions of the malware that use the domain generation algorithm (DGA) to keep its URLs moving targets from researchers and law enforcement.

Raff says the attackers don't appear to be a nation-state sponsored group, but they are out to steal as much information as they can from their victims. "The actual malware is doing everything… stealing browser session files, etc. They usually take everything and then sell" infected machines to other cybercriminals or nation-state spies.

Dell SecureWorks has also been watching the latest variant of the malware. "We have looked at the latest iteration -- we've been calling it Bugat v4 -- but haven't seen that particular plug-in downloaded yet. The malware has become more modular and there are different plugins delivered to different customers, so probably not all of them paid to get the spreader plugin," says Joe Stewart, director of malware research for Dell SecureWorks.

Stewart says the added email spreader and network sniffing are all things crimeware variants have used before. "It's really just another step in the evolution of this malware that closely follows development patterns we've witnessed in the past."

Technical details and screen shots of the attack are available here from Seculert.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.