The stealthiness of Linux/Cdorked: a clarification
We clarify that the Linux/Cdorked backdoor malware leaves no traces on the hard drive "other than its modified httpd binary" which can be scanned for detection in several ways.
Research
Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication
The mysterious Avatar rootkit, detected by ESET as Win32/Rootkit.Avatar, appears to reflect a heavy investment in code development, with an API and a SDK available, plus an interesting abuse of Yahoo Groups for C&C communications.
Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole
Analysis of a malicious backdoor serving Blackhole exploit pack found on Linux Apache webserver compromised by malware dubbed Linux/Cdorked.A, together with remediation tool and techniques.
Is Gapz the most complex bootkit yet?
Introducing a detailed analysis of Win32/Gapz malware in a new white paper titled: Mind the Gapz: The most complex bootkit ever analyzed?
Carberp: the never ending story
Aleksandr Matrosov reveals changes in banking Trojan Carberp relating to Java/Spy.Banker (AgentX.jar) and gaining remote access using legitimate software as backdoor components.
Job Scams: Nice Work If You Can Get It
The new ESET blog format must be striking a real chord with people. At any rate, job offers are just pouring in. Except that they don't seem to be jobs for security bloggers, or for web developers like the team that maintains this site.
Win32/Cridex: Java pushes Cyprus into a Blackhole
Banking crisis in Cyprus is now being used in a spam campaign promoting the Blackhole exploit kit and the Win32/Cridex Trojan.
Gapz and Redyms droppers based on Power Loader code
Technical analysis of Power Loader, a special bot builder for making downloaders for other malware families and yet another example of specialization and modularity in malware production.
Adobe and Microsoft release critical patches for March
Adobe and Microsoft have both released patches this week to address vulnerabilities in respective software applications and advise all users to apply the patches as soon as possible, if applicable to them.
Phishbait: not so much a Smile as a rictus
Below, you can see the textual part of a bank phishing email I received today (it also contained a Smile logo, which was the only graphical content). Here’s the message text from the phishing email: Dear Account Holder, Do you know that with Smile Internet banking, you can eliminate the cost of receiving and transferring
How Theola malware uses a Chrome plugin for banking fraud
A deep dive into Win32/Theola, one of the most malicious components of the notorious bootkit family, Win32/Mebroot.FX. Theola uses malicious Chrome browser plugins to steal money.
Sinkholing of Trojan Downloader Zortob.B reveals fast growing malware threat
Malware infecting 25,000 computers, mostly in the United States, pumping out 80 million spam messages per hour? ESET researchers sinkhole to investigate Win32/TrojanDownloader.Zortob.B
Hundreds of thousands of Facebook likes can certainly be wrong
Issues with malware are always with us. There may or may not be a current media storm, or companies hoping for a slice of the anti-malware pie by proclaiming the death of antivirus in a press release, but AV labs continue to slog their way every day through tens of thousands of potentially malicious samples.
Caphaw attacking major European banks using webinject plugin
Analysis of malicious code dubbed Win32/Caphaw (a.k.a. Shylock) attacking major European banks, with ability to automatically steal money when the user is actively accessing his banking account.
Code certificate laissez‑faire leads to banking Trojans
Technical analysis of malware that abuses code signing certificates normally used to positively identify a software publisher and to guarantee code is unchanged.
Free AV and relying on the luck of the Irish
ESET Ireland's Urban Schrott has blogged recently that "Research reveals nearly half of all Irish computers depend on free antivirus for protection".
It’s a wonderful hoax
In a world where nothing seems to be constant but change, it's good to know that there are, in fact, some things that change fairly slowly. Unfortunately, readiness to believe and spread hoaxes is one of them.
ComboFix fixed: popular utility safe to use
ESET’s threat researchers received a surprise earlier this week when they began receiving reports from ESET LiveGrid that downloads of ComboFix, a tool popular with advanced users for removing malware, were detected as being infected by a variant of the Sality virus, Win32/Sality.NBA.
Scandal video of Justin Bieber: just don’t click here!
I received a “shared” messages from a friend about “a leaked scandal video of Justin Bieber and Selana Gomez” promising a “naked Justin Bieber”, with a Photoshopped picture, which we – for family-friendliness – censored a bit.
What do Win32/Redyms and TDL4 have in common?
At the beginning of January 2013, we started tracking the interesting Win32/Redyms trojan family. Redyms is notable for changing search results from popular search engines on infected machines.