Feeds

Crooks charge premium for filter-evading Trojan

Chameleon malware from business-minded VXers

SANS - Survey on application security programs

Cybercrooks have released a custom-built Trojan, dubbed Limbo 2, "guaranteed" by its shady creators to continually evade the top ten anti-virus products on the market.

The Limbo 2 Trojan is touted as being able to bypass products from Symantec, McAfee, AVG and others to steal login credentials from online banking sessions. Crackers hawking tailored versions of the Trojan on underground forums are selling licences for up to $1,300, net security firm PrevX reports. The "guarantee" of non-detection represents a new level of sophistication in the underground malware business, which is borrowing more and more business models from the legitimate software industry.

According to an analysis by PrevX, the Limbo 2 Trojan features a changeable shell. While the payload and end result is the same, this pliable cloak can come in many guises allowing the malware package to present an almost unlimited number of variants. This technology is designed to allow Limbo 2 to slip past conventional signature-based anti-virus detection. Each variant sold is customised to feature the drop site for stolen information.

The Trojan goes beyond conventional key-logging techniques to include technology that generates spoofed information boxes on compromised PCs asking for users to enter more information than usual. Passwords, credit card information and other personal details are transmitted to the malware's owner. One thread about the malware on an underground forum had clocked up more than 15,000 hits, PrevX reports, indicating that the Trojan has generated plenty of interest in the black economy.

"The strength of this piece of Malware lies in its versatility, even if it is recognised up by an anti-virus company it can be changed so as to be invisible again within hours. There are likely to be so many variants out there that they will never all be detected, which is a scary thought as it is designed to steal bank details," said Jacques Erasmus, director of Malware Research at Prevx.

"Whoever designed this Trojan is making a lot of money, probably thousands of pounds every day," he added. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.