ForumGarden

PandaLabs uncovered a new malicious code, Banbra.GUC, which lures users with a video about the rescue of the trapped Chilean miners. This is a new variant of the infamous Banbra family of banker Trojans, which first emerged in 2003.

(from net security)






When run, the Trojan displays the video while it delivers its malicious payload. More specifically, the Trojan is designed to steal passwords for online banking services.

Among the banks affected are Banco Santander and the Banco do Brasil. If a compromised user visits any of the pages in question, Banbra.GUC downloads some executables that simulate the bank’s page. Once the user has entered their login details, the executable closes and redirects the user to the genuine Web page of the bank. The Trojan then sends all this information to its creator via email.

“This is a particularly dangerous Trojan, as in addition to stealing bank details it installs other malware which the cyber-criminals can control, warns Luis Corrons, Technical Director of PandaLabs. “Users must be very careful, as this type of Trojan is usually distributed in email messages or on social networks with links that seem to point to a YouTube video. However, they actually download the Trojan to the PC. In this case the Trojan does play the video to avoid raising any suspicion while infecting users, explains Corrons.

Oh, that is a mean thing to do.

chonsigirl;1331894 wrote: Oh, that is a mean thing to do.Isn't it just chonsogirl, sick.

binbag;1331942 wrote: Isn't it just chonsogirl, sick.


Except that it's untrue, at least as depicted above. YouTube's incapable of delivering a trojan. Some alternative video-display sites can attempt it by getting Media Player to use a corrupt codec. The default settings for Media Player cause it to ask for user permission to download and install the corrupt codec, which most normal users would refuse to grant. If the site's configured to look like YouTube then it's still a bogus site. YouTube delivers Flash content which can't embed corrupt codec calls.

spot;1331953 wrote: Except that it's untrue, at least as depicted above. YouTube's incapable of delivering a trojan. Some alternative video-display sites can attempt it by getting Media Player to use a corrupt codec. The default settings for Media Player cause it to ask for user permission to download and install the corrupt codec, which most normal users would refuse to grant. If the site's configured to look like YouTube then it's still a bogus site. YouTube delivers Flash content which can't embed corrupt codec calls.Hi spot, why not think about pointing that out to PandaLabs. If they are a reputable company I'm sure they would be grateful to receive your information.



bb

Here is a link to the article cited in the OP:

Chilean miners tragedy used to distribute malware

What's really alarming is that the article says the trojan can be passed along through e-mail and social networking sites, so even though it may be mimicking Youtube, clicking on the embedded video in a forum like FG could infect your computer.How could you tell it's not a legitimate Youtube video when it's on another site ?

Thanks for the warning, binbag.

binbag;1331961 wrote: Hi spot, why not think about pointing that out to PandaLabs. If they are a reputable company I'm sure they would be grateful to receive your information.



bbPerhaps if you provide a link to the original article I could comment more reliably. What part of my post do you disagree with - that would help.

eta: I cross-posted with the link from Richard - I'll go and take a look.

Richard Bell;1331969 wrote: Here is a link to the article cited in the OP:

Chilean miners tragedy used to distribute malware

What's really alarming is that the article says the trojan can be passed along through e-mail and social networking sites, so even though it may be mimicking Youtube, clicking on the embedded video in a forum like FG could infect your computer.How could you tell it's not a legitimate Youtube video when it's on another site ?

Thanks for the warning, binbag.


Reading the article it makes it quite clear that the trojan's not hosted on YouTube, that viewing the video from YouTube doesn't infect your computer, that the permission to install the trojan has to be granted by the user, and that (as I said earlier) no normal user would be so stupid as to give it when asked. As it says, "This Trojan can be distributed via email messages or links published in social networks, so you should be very cautious in this type of situations" - but not through YouTube videos. The answer's dead simple - don't ever run any executables you've not sought out yourself from a reputable source.

spot;1331970 wrote: Perhaps if you provide a link to the original article I could comment more reliably. What part of my post do you disagree with - that would help.

eta: I cross-posted with the link from Richard - I'll go and take a look.
"What part of my post do you disagree with - that would help".

Ya got me there spot, what part of your post did I disagree with?

Incidentally, the words in my initial post are from the report from net security...they are not my words.

Please don't shoot the messenger.

Richard Bell;1331969 wrote: Here is a link to the article cited in the OP:

Chilean miners tragedy used to distribute malware

What's really alarming is that the article says the trojan can be passed along through e-mail and social networking sites, so even though it may be mimicking Youtube, clicking on the embedded video in a forum like FG could infect your computer.How could you tell it's not a legitimate Youtube video when it's on another site ?

Thanks for the warning, binbag.


Richard Bell, I forgot to thank you for posting in the link.

Many thanks. bb