uyothasince 1992
denf
De

The blind are not afraid of snakes

Caution! Threat!
Banking Trojan
Trojan.Carberp!

weatercCaution! Threat! Banking Trojan Trojan.Carberp!

The blind are not afraid of snakes

One possible
way to get
infected withTrojan.Carberp

1. An accountant was reading articles on a health-related website. Her
computer had a remote banking system (RBS) installed on it.

This is a real incident that occurredin December 2012 in a company
located in Moscow.

4. But the browser was still stuck, and the accountant called the systemadministrator to come take a look.

2. The browser froze and displayed a window containing a warning
about a program malfunction.
3. Without thinking, the accountant clicked one of the window’s buttons
to get rid of the annoying window and get back to her article.

5. He logged in under his administrator’s domain password and solved
the problem with the browser. The accountant was able to continue
reading the important article. A Trojan, that had penetrated theaccountant’s computer unnoticed, was activated by the accountant
when she clicked the button in the browser window. Thus, criminals
were able to obtain the passwords to the banking system and theremote banking system (RBS).
6. The accountant didn’t use the RBS for a few days, but several million
roubles were stolen during that period.

Just 1 to 3 minutes are enough for a Trojan to steal passwords and money from a
victim’s account.

What are banking
Trojans?

These are dangerous malicious programs designed to:steal passwords for banking and payment system access andmoney from bank accounts;
download other malicious programs;
paralyze a computer when remotely commanded to do so by acriminal.
Trojan.Carberp is the most dangerous of these programs.

Currently plugins exist for most types of RBS.
Attention! Due to the nature of this scheme, which is used by attackers to infectsystems, small and medium-sized companies are most likely to be in danger.

What is the main
target of banking
Trojans?
Money.
It’s the only thing the hackers areinterested in.

2

Before stealing money, a Trojan’s owners collect information about their
future victim. They know the company’s account balance at any given
time, transfer amounts, and the reasons why variations in the accountoccur (the same reasons will be used to make fraudulent payments),
receive information about all the payments made by the company’saccountant. Thus, the victim is tracked 24/7 before their account isdrained. Fraudsters obtain the following information:3

Caution! Threat! Banking Trojan Trojan.Carberp!

The blind are not afraid of snakes

The Trojan’s owner has
information about the victim’s account and access toall information stored on theinfected computer.

Whether an RBS password was stolen
Bank accountBank account balanceDid a Trojan
sneak up on yourcomputer?

No! You invited it in!
Carberp family Trojans penetrate computers while victims browse
compromised sites. No action needs to be taken to get a system infected.
It occurs automatically.
The most dangerous websites for PCs are:

The amount of a transfer

1. Sites related to technologies and telecommunications.

The reason for payment

2. News portals, business outlets, accounting-related sites andforums, online courses/lectures, etc.

RBS compromised system (name)
WWW address of the RBS

3. Women’s sites (health, cooking).

Victim’s IP address

There is another way of transferring an infection: via removable media.

Used web browser
Important!
Removable media includes not only flash drives but also any USB device!
A virus can be transmitted from one PC to another even with a camera ora portable media player.

Whether a debit card was compromised
The bank BIN

Trojans are designed to be spread by users, because unlike viruses, theycannot replicate themselves without user intervention. People contributeto their propagation. That’s how a computer can get infected — evenwhen no Internet or network connection is present.

Account of the client or victim
Address of the e-payment system to which the compromised card
belongs
Card number

Office computers are no longer the only targets of cyber attacks—personaldevices (including mobile phones) are at risk too.

Card expiration date
Cardholder’s first and last names

A banking Trojan for the Android OS already exists: Android.
SpyEye.1.

CVV2/CVC2

Who needs it?

Today’s malware are developed by professional virus writers; this is a wellorganized criminal business involving many highly skilled software andapplication developers.

Are Trojans
undetectable?

Modern virus writers aim at creating malicious software thatshould remain undetected in a system for as long as possible —both by the user and special programs (anti-viruses).

An organized criminal group works to develop and «promote» a Trojan,
with the developers located in one country; the servers that distribute theTrojan in another; the organizers in a third country; and the «partners,»
who purchase a botnet segment for criminal use, located in multiple
countries.

For example, Trojan.Carberp, when launched on an infected
machine, undertakes several steps to avoid being detected bycontrol and monitoring systems. After launching successfully, theTrojan injects itself into running applications.

The program is constantly upgraded by its creators, and new Trojan
versions are churned out. Every day dozens of entries of Trojan.Carberp
are added into Doctor Web virus databases. And that’s only one Trojan
modification...

Facts
Every day Doctor Web’s anti-virus laboratory receives on average
about 60,000 malware samples.
A record was set on November 28, 2012, when the Doctor Web
anti-virus laboratory received more than 300,000 samples.
At the beginning of December, we saw another record! And that
number does not include every virus created that day.
Virus analysts are not magicians and are unable to instantly process thethousands and thousands of suspicious files that are received daily.
The risk of infection with an unknown virus is always present.
4

There exists a dangerous delusion that a virus’s actions are usually visible
and that a computer infection will be discovered instantaneously. But it’s
not true!

Why does thishappen?

1. Technologically sophisticated and dangerous viruses are created forcommercial purposes. Virus writers scan them with all available antiviruses.  That’s why many malware samples cannot be detected byanti-viruses before entering an anti-virus lab.
2. Trojans designed to steal money from a certain company may remain
undetected by an anti-virus if fraudsters know what anti-virus is usedby that company.
3. The Trojan penetrated the accountant’s computer exploiting several
vulnerabilities in the installed software. When she clicked the button in
the pop-up window, she activated the Trojan.  From that moment on,
the Trojan started stealing information from the victim’s computer.
5Caution! Threat! Banking Trojan Trojan.Carberp!

The blind are not afraid of snakes

4. Users, ignorant of computer security basics or simply tired or careless,unintentionally facilitate malware’s penetration of a network (byusing USB devices without scanning them with an anti-virus, opening
e-mails from unknown senders, and surfing the Web during workinghours).
In an effort to teach users security basics, Doctor Web creates training
courses, designed for a wide range of PC users, and offers free on-line
tests on computer basics. Knowledge acquired while studying suchcourses makes it easier to cope with computer threats and to not fall forcriminals’ tricks.
Doctor Web education portal:		
http://training.drweb.com			

Important!
Today, only an anti-virus can cure malware-infected systems.

What should I do?

Unfortunately the victim discovers the theft after the fact. But that’s no
excuse for inaction! In this case, how you respond is critical.
Important!
Do not attempt to update the anti-virus or run a scan—you may
destroy the traces of intruders in the system!
Do not attempt to reinstall the operating system!
Do not attempt to remove any files or programs from the disk!
Never use a computer from which e-banking systemauthentication credentials have allegedly leaked, even if there isan urgent need to do so!
There are no statistics showing the amount of money stolen from online
banking systems using malicious software. Quite often victims do notnotify law enforcement authorities, believing that they won’t get theirmoney back. They do not know how to act in this situation or how toinitiate an investigation. They end up spinning their wheels.
Money theft using malware is a crime. Law enforcement authorities
need your formal complaint (i.e., a legal reason) to initiate a criminalcase against intruders.  Remember: There may be many victims, but
you may be the first one to notice the criminal activity and contact theauthorities, in which case, your complaint may lead to the curtailment of
the intruders’ activities.
Every criminal leaves traces. Computer criminals are no exception—i.e.,
we can and must fight them.

67© Doctor Web, 2003 — 2013125124, Russia, Moscow, 3d street Yamskogo polya 2-12А
Phone: +7 (495) 789-45-87
Fax: +7 (495) 789-45-97
www.drweb.com   |   estore.drweb.com   |   www.drweb-curenet.com      www.av-desk.com   |   www.freedrweb.com   |   mobi.drweb.com