A YouTube religious video used as bait to infect users with malware

PandaLabs has discovered a banker Trojan, Banker.LSL, which exploits the proximity of the Easter holidays to trick users with a religious video

Once on the infected computer, the malware captures keystrokes, mouse movements, etc. to get users’ banking passwords and steal their money

4/8/2009. PandaLabs, Panda Security’s malware detection and analysis laboratory, has detected a new malicious code, Banker.LSL, which uses the proximity of the Easter holidays to trick users with a YouTube religious video in Portuguese (watch it here: http://www.youtube.com/watch?v=PAjpLvtyx1I )

Once run, the worm displays the video while it delivers its malicious payload. More specifically, the Trojan is designed to steal passwords for online banking services. Banker.LSL captures:

- Key strokes
- Mouse movements
- Mouse clicks
- Screenshots
- Online forms filled in by the user.

The Trojan downloads a series of TXT files where it saves the information it has obtained, and tries to send them to a Web page.

“Users must be very careful, as this type of Trojan is usually distributed in email messages or Internet forums with links that seem to take to a YouTube video. However, they actually download the Trojan to the PC. In this case the Trojan does play the video to avoid raising any suspicion while infecting users”, explains Luis Corrons, Technical Director of PandaLabs.

About PandaLabs
Since 1990, its mission has been to analyze new threats as rapidly as possible to keep our clients safe. Several teams, each specialized in a specific type of malware (viruses, worms, Trojans, spyware, phishing, spam, etc), work 24/7 to provide global coverage. To achieve this, they also have the support of TruPrevent® Technologies, which act as a global early-warning system made up of strategically distributed sensors to neutralize new threats and send them to PandaLabs for in-depth analysis. According to Av.Test.org, PandaLabs is currently the fastest laboratory in the industry in providing complete updates to users. More information is available in the PandaLabs blog.

For more information: http://www.pandasecurity.com/homeusers/security-info/

Source: Panda Security
http://www.pandasecurity.com/

2009-04-09 15:48

Back

IT News: