BANKER Malware Found Hosted on Google Code

snoopy · Aug 18, 2013

BANKER Malware Found Hosted on Google Code

Google Code is Google’s official open source site meant for developers to host their program’s source code and related files, mostly in text format. However, using our sourcing system in Brazil, we were able to capture a malware written in Java that downloads BANKER malware from a recently created project called “flashplayerwindows”. Of course, this bogus project has nothing to do with Adobe.

The said file (detected as JAVA_DLOAD.AFJ) is a compiled file that downloads and execute the “AdobeFlashPlayer.exe”, which we have verified to be malicious (detected as TSPY_BANKER.VIX, renamed from TROJ_BANLOAD.JFK). Once executed, this Trojan connects to Google Code to download other files. The people behind this threat may have uploaded these files to the said Google Code page, which notably include BANKER variants. These malware are notorious for stealing banking and email account information. Typically, they perform their data stealing routine by using phishing sites spoofing banking sites to lure users into disclosing information. Once they gather these data, they can use these to initiate unauthorized transactions such as money transfers.

Click to expand...

More on this topic - http://blog.trendmicro.com/trendlab...e/banker-malware-found-hosted-on-google-code/

Log in or Sign up

BANKER Malware Found Hosted on Google Code

snoopy Registered Members

Share This Page

Log in or Sign up

BANKER Malware Found Hosted on Google Code

snoopy Registered Members

Share This Page

Useful Searches