bugtraq - Re: Iframe-Cash/Iframe-Dollars Adware bundle...oooh... my ....god..

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 13 Mar 2007 18:15:57 +0100
From: Reversemode <advisories@...ersemode.com>
To: Securityfocus <bugtraq@...urityfocus.com>
Cc: Thierry Zoller <Thierry@...ler.lu>
Subject: Re: Iframe-Cash/Iframe-Dollars Adware bundle...oooh... my ....god..

Hi,

The BHO you are talking about is part of a banking malware toolkit which
is  being sold probably.

Among other things (password stealer), this BHO has backdoor and
"botnet" capabilities, implementing several remote commands:
+ upload
+ run
+ update
...

This toolkit also comprises various "infection management system" php
scripts :
+ statistics  about infections, countries...
+ users/victims tracking
+ logs parsing
...
The BHO communicates directly with those scripts for sending and/or
receiving captured information and remote commands respectively.

Watch out for unexpected http traffic containing
commandack.php,mailwab.php..

Cheers,
-Rubén.