{"id":2862,"date":"2010-06-21T14:06:35","date_gmt":"2010-06-21T21:06:35","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=2862"},"modified":"2018-01-30T12:26:56","modified_gmt":"2018-01-30T19:26:56","slug":"keylogger-poses-as-document-from-spains-central-bank","status":"publish","type":"post","link":"https://www.webroot.com/blog/2010\/06\/21\/keylogger-poses-as-document-from-spains-central-bank\/","title":{"rendered":"Keylogger Poses as Document from Spain’s Central Bank"},"content":{"rendered":"

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"\"<\/a>An attempt to push down the Trojan-Backdoor-Zbot<\/strong> password thief to Spaniards may signal a new wave of attacks by a crew of attackers who spent the better part of 2009 trying to convince gullible Internet users in different countries to download and execute Zbot installers poorly disguised as transaction records or other important financial documents.<\/p>\n

A bogus Banco de Espa\u00f1a<\/strong> (BdE) Web site<\/a> came and went quickly last week, but not before we took a deep dive and came up with a mouthful of malware. Believe me, it tasted terrible.<\/p>\n

The page, designed to mimic closely the appearance of the Spanish central bank’s Web site, was very much a clone of the previous fake-bank pages used to foist Zbot onto victims.<\/p>\n

Previous campaigns of this type targeted, primarily, North American victims by spoofing the Web sites belonging to Visa<\/a>, Bank of America, the FDIC<\/a>, the American Bankers Association<\/a>, NACHA<\/a>, the IRS (and its equivalent British<\/a> tax authority), as well as Amazon.com<\/a>, iTunes<\/a>, Facebook<\/a>, MySpace<\/a>, AOL<\/a>, the Centers for Disease Control and Prevention<\/a>, and many others.<\/p>\n

<\/p>\n

The fake Banco de Espa\u00f1a Web page, hosted on a server based in Russia, followed the same pattern set in so many previous Zbot campaigns: The URL included some of the real financial entity’s domain name, but was actually hosted on a server elsewhere; The potential victim was encouraged to download and open some sort of financial statement (the file itself was labeled “declaracion.exe” (statement) and the visitor was instructed to descargar declaraci\u00f3n<\/em> (“download statement”). Of course, this declaraci\u00f3n<\/em> was the Zbot installer. After the computer became infected, the keylogger downloaded instructions from a different Russian Web domain, then lay in wait for a victim to log into his or her online bank accounts or other Web sites.<\/p>\n

\"\"<\/a><\/p>\n

While we haven’t seen this trick in several months, the low-key approach by Zbot’s distributors doesn’t make the Trojan any less dangerous. It’s capable of stealing saved passwords from Internet-connected applications, browsers, cookies, Remote Desktop, and the Protected Storage area within Windows. It’s a password stealing machine, literally and figuratively.<\/p>\n

As we’ve seen in previous Zbot fake-page scams, the Web site doesn’t actually rely on the potential victim downloading and executing the Zbot installer him- or herself. Just by visiting the fake page, you can become infected: If the visitng PC is running an older version of Internet Explorer, the page tries to use browser exploits to push malware down to the victim. In this case, we also came down with a case of Trojan-Pushu<\/strong>, a spambot.<\/p>\n

The same advice to users applies in each of these cases: Don’t follow links in email that purport to lead to a page on your country’s central bank (unless, of course, you happen to be your country’s finance minister, or work for the central bank’s Web team, in which case you shouldn’t click any links leading to Web sites in the .ru top-level domain); Don’t download or execute any Declaraci\u00f3n<\/em> with a file extension of .exe<\/strong>; and use the Firefox browser with the NoScript plugin as a way to safeguard your computer against unexpected attacks.
\n\"wordpress<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

An attempt to push down the Trojan-Backdoor-Zbot password thief to Spaniards may signal a new wave of attacks by a crew of attackers who spent the better part of 2009 trying to convince gullible Internet users in different countries to download and execute Zbot installers poorly disguised as transaction records or other important financial documents. […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[7575,7569,7591,7587,7579,7577,4481,7573,3919,7581,7589,7585,7571,7049,3471,4313,4621,6089,6973,7583],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/2862"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=2862"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/2862\/revisions"}],"predecessor-version":[{"id":23738,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/2862\/revisions\/23738"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=2862"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=2862"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=2862"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=2862"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}