Dmitry Bestuzhev, in his blog 'SecureList' has provided an overview of banking trojans originating from Brazil.
http://www.securelist.com/en/analysis/204792084/Brazil_a_country_rich_in_banking_Trojans
Many of the online banking customers in Brazil fall victims to bank frauds facilitated by banking trojans.
The trojans are propagated via infected websites and the customers are lured to these sites through spam mails, phishing mails and social engineering tactics.
Social networking sites are used to collect data on users-- names, date of birth, address, social status, etc. Orkut is popular in Brazil.
The trojan downloaded, in turn downloads and installs other malicious programs-- to steal account data from social networking sites, for anti-virus evasion and for monitoring user activity and connection to banking sites, session hijacking, data harvesting and data transmission.
Anti-rootkit program such as Avenger is used to combat anti-virus solutions. Partizan, another anti-rootkit is also used.
Stolen data is forwarded to a remote database server. IP addresses and MAC addresses are also stolen and used to spoof source addresses. Stolen email addresses and passwords are sent to remote web servers.
Cyber criminals use money mules to transfer the money and to recover proceeds of the crime.
Banking trojan samples are mostly written in Delphi. some samples are infected with viruses such as Virut . Legal web pages are compromised and used to distribute malicious programs.
The trojan code has huge file size and has Portuguese strings in the code.
Stolen data is sent via secure channels.
An anti-rootkit called Partizan is used to remove bank's security plug-in. This anti-rootkit is part of the Russian edition of the UnHackMe program.
Though the malware writers many be Brazilian, Russian cybercriminals appear to be stealing money from Brazilian banks.
Further details at:
http://www.securelist.com/en/analysis/204792084/Brazil_a_country_rich_in_banking_Trojans
-Joseph Ponnoly
