BitDefender releases free removal tool for Carberp Trojan
November 2010
IT in Manufacturing
Standalone utility available for free download on MalwareCity.com to protect against growing threat from potent banking Trojan.
BitDefender has announced a free removal tool targeting the Trojan.Downloader.Carberp.A. Building on the technologies implemented in Zeus and Brazilian Bankers, Trojan.Downloader.Carberp.A has rapidly obtained its place among a rather exclusive club of banking Trojans. It is designed to intercept, manipulate and steal confidential information a user might send or receive over the internet.
Trojan.Downloader.Carberp.A snatches details from websites that require log-in sessions over a SSL connection such as online banking services and e-mail providers. Apart from keeping an eye on every service that is important enough to force SSL authentication, Trojan.Downloader.Carberp.A is also instructed to monitor a list of websites containing several e-banking portals.
“Once executed on a computer, Trojan.Downloader.Carberp.A creates a couple of temporary files in the %temp% folder, then copies itself to the Windows Startup folder in order to self implement after every boot or restart,” said Catalin Cosoi, head of the BitDefender Online Threats Lab. “This approach may seem basic compared to other families of malware that add startup entries to the Registry, however, it is this depreciation that allows Trojan.Downloader.Carberp.A to execute itself on newer operating systems, or run on users’ accounts that do not have administrative privileges.”
Right after infection, the downloader connects to a C&C server, from which it will download an encrypted configuration file, along with additional fire-power such as plug-ins. This allows Trojan.Downloader.Carberp.A to intercept Internet traffic and to kill whatever antivirus it may find on the recently infected computer. It then sends the C&C server a unique ID and uploads a list of currently running processes via a GET request.
After it has successfully copied itself in the startup folder as either syscron.exe or chkntfs.exe, Trojan.Downloader.Carberp.A hides its presence by using function hooks in ntdll.dll in order to intercept any calls to NtQueryDirectoryFile and ZwQueryDirectoryFile. This means the user cannot see its files when using Windows Explorer or the command-line dir query.
Cosoi continues, “Every time a user logs in using SSL-based authentication to gain access to online banking, e-mail and social network accounts Trojan.Downloader.Carberp.A steals their details, before they are encrypted, and sends them to its C&C server over HTTP. By the time the log in request reaches the bank the credentials will already have fallen into the hands of the attackers.”
Trojan.Downloader.Carberp.A also targets certain banks in Germany, Denmark, the Netherlands, America and Israel following precise instructions that it receives from the C&C server along with configuration instructions. This sophisticated approach provides a lucrative financial tool designed to steal money from online service customers and SMBs. Trojan.Downloader.Carberp.A is also able to install without administrator privileges, attack systems that run the latest versions of OSs and doesn’t make any changes in the Registry or in critical areas of the operating system.
BitDefender customers have been protected since day zero via generic packer routines already included in the signature database. For those not protected by a BitDefender product, a free removal tool can be downloaded from the Downloads section of MalwareCity.com
For a full list of BitDefender 2011 features and benefits by product, visit www.bitdefender.com/world
For more information contact Alina Anton, senior PR & marketing coordinator, EMEA & APAC Business Unit, BitDefender, +40 212 063 470, [email protected], www.bitdefender.com
Further reading:
Overcoming the bottling industry’s fragmented visibility
Schneider Electric South Africa
IT in Manufacturing Electrical Power & Protection
Beverage bottling facilities are among manufacturing’s most energy-intensive environments, yet many still operate without granular insight into where that energy goes. Rezolia Muller-Potluri of Schneider Electric explains how tiered metering architecture and advanced
Read more...
Advancing intelligent apparel manufacturing with industrial AI and humanoid robotics
IT in Manufacturing
Jack Technology, a global maker of industrial sewing equipment, has chosen Siemens software and engineering tools to bring artificial intelligence and humanoid robots into apparel production, aiming to shorten development cycles and lift manufacturing efficiency.
Read more...
New chiller line for high-density AI data centres
Schneider Electric South Africa
IT in Manufacturing
Schneider Electric has launched the Uniflair XCA, a new series of air-cooled and free-cooling chillers designed for artificial intelligence-driven, high-density liquid-cooled data centres.
Read more...
Turning system integrators into trusted technology partners
Schneider Electric South Africa
IT in Manufacturing System Integration & Control Systems Design
Schneider Electric’s Alliance Partner Programme is repositioning system integrators from hardware suppliers into lifecycle-value partners. Oriel Soupen explains the competency framework, certification model and real-world results that are already helping African system integrators win higher-value, longer-term engagements.
Read more...
Why renewable projects need integrated protection and control
IT in Manufacturing
Fragmented secondary plant integration in renewable energy projects causes costly delays during commissioning. ACTOM Protection and Control’s Secondary Plant Integration solution consolidates all secondary systems under a single engineering framework, reducing risk and accelerating grid
Read more...
When digital twins move from concept to critical tool
IT in Manufacturing System Integration & Control Systems Design Maintenance, Test & Measurement, Calibration
Digital twins are moving out of the lab and onto the mine, the factory floor and the transport network where they predict failures before they happen. Amritesh Anand looks at where they earn their keep, the data and integration work behind them, and the security questions every organisation should ask before switching one on.
Read more...
How a digital foundation can overcome the LNG trilemma
Schneider Electric South Africa
IT in Manufacturing SCADA/HMI
The LNG sector is racing to add capacity, but without a digital backbone, growth creates complexity rather than capability. Christophe Begat of Schneider Electric explains how connecting data, systems and analytics across the LNG value chain can resolve the trilemma of secure supply, lower emissions and tighter costs.
Read more...
Decarbonisation is reshaping mining strategy in Africa
Schneider Electric South Africa
IT in Manufacturing Electrical Power & Protection
Mining companies across Africa are embedding decarbonisation into operational strategy, driven by investor, regulatory and customer pressure to reduce emissions while improving resilience.
Read more...
Siemens and HighByte partner to scale industrial AI
Siemens South Africa
IT in Manufacturing Fieldbus & Industrial Networking
Siemens is expanding its Industrial Edge ecosystem through a partnership with HighByte, enabling customers to connect, contextualise and transform data from operational technology and information technology sources to build AI models and applications at scale.
Read more...
Africa on the edge of a digital future
Schneider Electric South Africa
IT in Manufacturing
Edge computing promises lower latency, stronger reliability and real-time responsiveness across Africa, yet its rollout keeps colliding with one stubborn obstacle, power. Steven Santini explores how renewable microgrids, smart energy management and the right partnerships could turn the continent’s energy gap into its biggest edge opportunity.
Read more...
printer friendly version