BitDefender releases free removal tool for Carberp Trojan
November 2010
IT in Manufacturing
Standalone utility available for free download on MalwareCity.com to protect against growing threat from potent banking Trojan.
BitDefender has announced a free removal tool targeting the Trojan.Downloader.Carberp.A. Building on the technologies implemented in Zeus and Brazilian Bankers, Trojan.Downloader.Carberp.A has rapidly obtained its place among a rather exclusive club of banking Trojans. It is designed to intercept, manipulate and steal confidential information a user might send or receive over the internet.
Trojan.Downloader.Carberp.A snatches details from websites that require log-in sessions over a SSL connection such as online banking services and e-mail providers. Apart from keeping an eye on every service that is important enough to force SSL authentication, Trojan.Downloader.Carberp.A is also instructed to monitor a list of websites containing several e-banking portals.
“Once executed on a computer, Trojan.Downloader.Carberp.A creates a couple of temporary files in the %temp% folder, then copies itself to the Windows Startup folder in order to self implement after every boot or restart,” said Catalin Cosoi, head of the BitDefender Online Threats Lab. “This approach may seem basic compared to other families of malware that add startup entries to the Registry, however, it is this depreciation that allows Trojan.Downloader.Carberp.A to execute itself on newer operating systems, or run on users’ accounts that do not have administrative privileges.”
Right after infection, the downloader connects to a C&C server, from which it will download an encrypted configuration file, along with additional fire-power such as plug-ins. This allows Trojan.Downloader.Carberp.A to intercept Internet traffic and to kill whatever antivirus it may find on the recently infected computer. It then sends the C&C server a unique ID and uploads a list of currently running processes via a GET request.
After it has successfully copied itself in the startup folder as either syscron.exe or chkntfs.exe, Trojan.Downloader.Carberp.A hides its presence by using function hooks in ntdll.dll in order to intercept any calls to NtQueryDirectoryFile and ZwQueryDirectoryFile. This means the user cannot see its files when using Windows Explorer or the command-line dir query.
Cosoi continues, “Every time a user logs in using SSL-based authentication to gain access to online banking, e-mail and social network accounts Trojan.Downloader.Carberp.A steals their details, before they are encrypted, and sends them to its C&C server over HTTP. By the time the log in request reaches the bank the credentials will already have fallen into the hands of the attackers.”
Trojan.Downloader.Carberp.A also targets certain banks in Germany, Denmark, the Netherlands, America and Israel following precise instructions that it receives from the C&C server along with configuration instructions. This sophisticated approach provides a lucrative financial tool designed to steal money from online service customers and SMBs. Trojan.Downloader.Carberp.A is also able to install without administrator privileges, attack systems that run the latest versions of OSs and doesn’t make any changes in the Registry or in critical areas of the operating system.
BitDefender customers have been protected since day zero via generic packer routines already included in the signature database. For those not protected by a BitDefender product, a free removal tool can be downloaded from the Downloads section of MalwareCity.com
For a full list of BitDefender 2011 features and benefits by product, visit www.bitdefender.com/world
For more information contact Alina Anton, senior PR & marketing coordinator, EMEA & APAC Business Unit, BitDefender, +40 212 063 470, [email protected], www.bitdefender.com
Further reading:
Even in autonomous systems, human insight is important
Schneider Electric South Africa
IT in Manufacturing
As AI, IIoT and digital twins reshape industrial operations, Schneider Electric’s Kobus Vermeulen and Bafana Msibi argue that the operator’s role is shifting from controlling equipment to interpreting intelligence, validating AI recommendations and making decisions that improve
Read more...
AI-based quality inspection scales across P&G operations
Siemens South Africa
IT in Manufacturing
Siemens and Procter & Gamble are expanding an AI-based visual inspection system across P&G’s manufacturing operations worldwide, inspecting products in real time at full line speed, and reducing scrap rates by 10 to 20% depending on the product.
Read more...
How sustainability unlocks real business impact
Rockwell Automation
IT in Manufacturing
Sustainability has moved from a compliance obligation to a strategic driver of resilience and value for manufacturers. Rockwell Automation explains how its Triple A framework and connected-data approach help producers cut energy, water and waste while improving productivity.
Read more...
Mining’s AI future will depend on people as well as technology
IT in Manufacturing
South Africa’s mining industry is embracing digitalisation and AI, but AvenirHoldings chief executive officer, Tshidi Mndzebele says the real test is whether the people behind the industry are equipped to move forward with it, and outlines five things mining needs to get right.
Read more...
How BIC overcame operational silos to integrate technology and people
Rockwell Automation
IT in Manufacturing
Manufacturing giant BIC deployed Plex MES from Rockwell Automation at its Bizerte plant in Tunisia, replacing fragmented, partly in-house software with a single cloud-based execution system that broke operational silos and improved shop-floor visibility.
Read more...
AI in industry is an early warning system, not a guarantee
Schneider Electric South Africa
IT in Manufacturing
Schneider Electric’s Paul Steyn argues that AI in industrial maintenance is only as good as the infrastructure and people behind it, and explains the three layers a facility needs before predictive maintenance can deliver on its promise.
Read more...
SA’s mining industry must put people at the heart of its digital future
IT in Manufacturing
South Africa’s mining industry employs around 470 000 people while its digital transition accelerates. Avenir’s chief executive officer, Tshidi Mndzebele argues that technology should enable and upskill the workforce rather than replace it, setting out five ways mining can make technology work for its people.
Read more...
Quality control supports efficient tissue production
Valmet South Africa
IT in Manufacturing
Valmet’s advanced quality control technology is helping tissue producers improve product consistency while reducing energy and raw material consumption. Its latest installation at KORO Paper in Vietnam combines real-time measurement, process optimisation and non-contact, nuclear-free quality control.
Read more...
Patented algorithm maximises operator efficiency
Rockwell Automation
IT in Manufacturing
Rockwell Automation piloted a patented anomaly detection algorithm and FactoryTalk DataMosaix at its Twinsburg electronics plant, giving operators 30 to 60 days’ advance warning of stencil failure, improving fail rates by 22% and achieving a 200% return on investment.
Read more...
Cybersecurity must become part of the next era of industrial automation
Adroit Technologies
IT in Manufacturing
The EU’s Cyber Resilience Act is setting a global benchmark for connected products, making cybersecurity a core engineering requirement in industrial automation. Adroit Technologies and Mitsubishi Electric explain how building security into controllers, PLCs and drives from the outset helps South African manufacturers protect production and meet international expectations.
Read more...
printer friendly version