US Warns Of Malware That Steals Money From Bills

Internet users should beware of a malware family that can steal money from bank accounts and computers can use for DDoS attacks, so let's Computer Emergency Readiness Team of the US Government (US-CERT), the Ministry of Justice and the FBI in a warning know.

Although Dridex-malware for more than one year exists, the government decided today to internet users for this threat warning. To infect computers with Dridex are mainly used e-mail attachments with Word documents. The e-mails look legitimate, and try to let the user open the attachment. In reality, the Word document containing a malicious macro. Once the macro is activated Dridex which will install on the system.

Macros are disabled by default in Word and users must also enable it manually. In spite of this extra step Dridex is successful. In case of a successful infection, the authorities recommend using a virus, change passwords and apply special remove programs. It is also advised to keep windows and installed applications up-to-date.

Malware Hijacks Microsoft Outlook To Send Email

Researchers have discovered that a Trojan on infected computers used Microsoft Outlook to send infected emails. It is a variant of the Dyre banking Trojan , also known as Dyreza . The malware is specifically designed to steal money from online bank accounts.

The now discovered variant spreads via email attachments posing as faxes or contain a message from an undelivered package and Upatre downloader. This downloader downloads the weather Dyre Trojan on the system, which installs a worm on the computer. The worm uses Microsoft Outlook on the computer to send infected e-mails with Upatre downloader. In addition, the malware does not use the address book of the victim, as it was done by many worms in the past. After the messages are sent, the worm deletes itself again, as reports of anti-virus company Trend Micro.

Hashes:

f50c87669b476feb35a5963d44527a214041cc2e – TROJ_UPATRE.SMBG

5250d75aaa81095512c5160a8e14f941e2022ece – TSPY_DYRE.YYP

9860d5162150ea2ff38c0793cc272295adf1e19a – WORM_MAILSPAM.XDP

Trojan Horse Hidden Communication Via Invisible Internet Project (I2P)

The makers of a Trojan horse that is specifically designed to steal money from bank accounts have released a new variant that uses I2P to communicate with infected computers. I2P stands for Invisible Internet Project (I2P) and is a network layer allowing application messages safely and pseudo -Anonymous can exchange.

According PhishMe security company that the new variant discovered I2P can be seen as a "secure version of Tor". Thus true DNS destination is standard shielded and it features peer-to-peer features, IP2 each node can act as an exit node. At the Tor network servers must be specifically set as an exit node.

In the case of the Dyre banking Trojan , also known as Dyreza, I2P provides the attackers a separate communication channel which is difficult to analyze and detect. Yet managers are not powerless says analyst Ronnie Tokazowski. Indeed, it is possible to capture I2P on the top-level domain (.i2p) off and thus stop the spread and possibly make IP2 traffic network harmless.