Panda Software Reports New Trojan That Could Steal Online Banking Passwords of Thousands of Spanish-Speaking Users

A new Trojan, Nabload.U, which is distributing itself through Messenger, has appeared a few hours ago. This Trojan downloads another Trojan, called Banker.bsx, which is currently the number one detected piece of malware from Panda's ActiveScan. Its objective is to obtain the passwords of certain banks that it has stored in its code primarily from Spanish-speaking users.
The most unusual aspect of this Trojan is its ability to capture the information without the use of a traditional key logger. The user will be unaware that this is occurring. Banks that use virtual keyboards to avoid keyloggers won't be protected from this Trojan.
Once the author has the keys, he can commit banking fraud with the accounts.
According to Luis Corrons, PandaLabs director: "This Trojan is an example of a hybrid virus that mixes different techniques. Once the user clicks on the URL, it is able to download a Trojan and use techniques similar to some spyware and phishing attacks. It is, without a doubt, a Trojan designed to steal data quickly, and without leaving any tracks."
Nabload.U uses social engineering techniques to get the user to click on the URL provided. The sentence is in Spanish: "ve esa vaina http://hometown.%eliminado%.au/miralafoto/foto.exe." It is disguised as a personal contact. When the user clicks on this URL, another Trojan, Banker.BSX, is downloaded. It also offers two others URLs http://hometown.%eliminado%.au/arqarq/coco2006.jpg and http://hometown.%eliminado%.au/modnatal/coco2006.jpg that downloads a configuration file. In this file, you can find -- as well as other information -- the e-mail address where the stolen data will be sent.
This Trojan opens up port 1106 on the computer and stays active. So, when the user tries to access one of the online bank addresses shown bellow, the Trojan will be able to capture what the user is doing on the screen, including the login and password typed by virtual keyboards to access the bank account. This Trojan only captures the information from the addresses below:
* https://secure2.venezolano.com/
* https://e-bdvcp.banvenez.com
* https://www.ibprovivienda.com.ve/personas/
* https://banco.micasaeap.com/individualmc/
* https://olb.todo1.com/servlet/msfv/
* https://www.banesco.com/servicios_electronicos_pag.htm
* https://www.banesconline.com
* https://www.provinet.net/shtml/
* https://bod.bodmillenium.com
* https://www.corp-line.com.ve/personas/
Once the Trojan has captured the information, it sends this data to an e-mail address. The author can change this e-mail address as desired.
To help as many users as possible scan and disinfect their systems, Panda Software offers its free, online anti-malware solution, Panda ActiveScan, which now also detects spyware, at http://www.pandasoftware.com/activescan/ . Webmasters who would like to include ActiveScan on their Web sites can get the HTML code, free from http://www.pandasoftware.com/partners/webmasters .
TruPrevent(TM) detection technologies detect and eliminate Banker.BSX with no need for previous updates, so computers with these technologies have been protected from the moment the Trojan Horse appeared.
For further information about Nabload.U and Banker.BSX, visit Panda Software's Encyclopedia.
About Panda Software
Panda Software (http://www.pandasoftware.com ) is a leading developer and provider of integrated security solutions to combat viruses, hackers, Trojans, spyware, phishing, spam and other Internet-borne threats. With the revolutionary TruPreventTM Technologies, Panda Software's innovative solutions offer a greater return on investment, keeping clients protected even against new threats that have yet to be identified. PandaLabs, the fastest laboratory in the industry to provide complete updates to users, offers a worldwide response to malware 24 hours a day, 7 days a week, all year round.
Panda Software's centrally-managed security solutions protect servers, and gateways and all network entry points, ensuring a straightforward and highly effective line of defense against Internet threats for large organizations, SMBs and consumers. Panda solutions are backed by a team of expert support technicians in all countries where the company is present. Tech support services are available 24 hours a day, seven days a week.
For more information and evaluation versions of all Panda Software solutions, visit our Web site at: http://www.pandasoftware.com/.

Author:  

Email:    

Topic:    

Content:

Related Articles

• Rouge AntiSpyware Programs Create Problems for Computer Users
  27 December 2005



• Computer Reseller News and SC Magazine Honor Astaro Unified Threat Management Appliances, Software
  25 December 2005



• StarForce Technologies Presents New IT Security software Safe’n’Sec+Anti-Spyware
  25 December 2005



• Privacyware Releases Upgrade of Award-winning Behavioral Anomaly Detection and Intrusion Prevention Software
  22 December 2005



• Panda Software Teams Up Once Again With Save the Children
  21 December 2005



• MacScan, Long Awaited Spyware Protection Software, Released for Mac OS X
  20 December 2005



• Recruitment software sales opportunity
  19 December 2005



• Patron Systems Partners with TriTech Software Systems to Serve Minneapolis Police Department
  18 December 2005



• The Bagle Trojan-Worm Combination Strikes Again, Warns Panda Software
  18 December 2005



• SonicWALL Keeps Users Secure in the Face of Microsoft Flaw
  18 December 2005