O segundo webinar contou com a palestra do Analista da Kaspersky Fabio Assolini que realizou uma excelente apresentacao sobre utilizacao de proxies maliciosos por malwares brasileiros para o roubo de informacoes.Nela ele contou um pouco da historia da evolucao do uso por parte dos atacantes e tecnicas utilizadas .Apos a apresentacao ele respondeu inumeras questoes.Quem nao assistiu vale a pena e quem viu provavelmente assistira novamente (1h10min)!https://trustwave.webex.com/trustwave-pt/lsr.php?AT=pb&SP=MC&rID=60315972&rKey=4069486ea128ec19 Links: http://www.twitter.com/assolinihttp://brazil.kaspersky.com/http://www.trustwave.com/spiderlabshttp://www.snort.org.brAte o proximo!Equipe Malwares-BR I am writing in English so it's easier to share with friends around the globe. Also, I do not expect this blog being visited by Brazilian end-users.IntroductionOn this part1 I will analyze the same sample of the last post within a different point of view, focused on the malware analyze without looking at the code, with some screenshots and some thoughts on the remote host compromise.In the next posts, I will unpack the malware, compare VT results packed vs unpacked and later analyze the code, figuring out how the malware load the target URL.So, this post may be interested for only whoever never saw a Brazilian banker.The sample itselfI won't run through the behavioral analysis (file system, registry access, etc), for that you can take a look at the previous post here. Also, most of the Brazilian bankers (if not all) don't use to be persistent or advanced, like adding itself to registry, perform API hooking, process injection, etc. Most of them are simple applications developed under higher-level languages such as Delphi and Visual Basic and sometimes packed with known packers, I haven't seen yet a Brazilian banker packed by a custom packer. Please, let me know if you have one of those, I would love to have a look.The design looks good, it says "Atualizacao de Seguranca" which means "Security update". Basically, the attacker is trying to get bank information from the victim providing him a security update, something like you need to provide your bank password in order to be secure, you would not do that but someone will, for sure. In my point of view, there are only two mistakes by the author, the hyperlinks are not working and "Modulo de Seguraca" should be "Modulo de Seguranca" which means "Security Module", classic typo, not a big deal, my mom would not even notice that.Then you just need to choose your account type: "Bradesco - Pessoa Fisica" or "Bradeco - Prime", I don't know why that since for both you need to provide the same information. Once you choose your account type a message is displayed saying the information exchange will only be available for you and the bank. This is a default behavior for bankers, repeat a couple of times you are secure, I have never saw that amount of messages from my real bank.Once you type agency and account, a virtual keyboard is displayed, like in real the bank website, it's fairly the same. The application does not even let you type the password if you don't do through the virtual keyboard.Once you click on "Enviar" which means "Send", another message is displayed saying that your