TROJ_VILSEL.AE

Versucht, Daten zu entwenden, wie z. B. Benutzernamen und Kennwörter, die beim Anmelden auf Websites von Banken oder anderen Finanzdienstleistern verwendet werden.

Andere Systemänderungen

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\WindowsUpdate\
ServiceWinlogom

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
RunInvalidSignatures = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

Ändert die folgenden Registrierungseinträge:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
CheckExeSignatures = no

(Note: The default value data of the said registry entry is yes.)

Einschleusungsroutine

Schleust die folgenden Dateien ein:

• %System%\NOVAINFECCAO.log

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows XP und Server 2003.)

Datendiebstahl

Überwacht auf dem betroffenen System die Aktivitäten von Internet Explorer (IE), insbesondere die Adressleiste. Erstellt eine rechtmäßige Website mit einer gefälschten Anmeldeseite, wenn ein Benutzer Banking-Websites mit den folgenden Zeichenfolgen in der Adressleiste und/oder Titelleiste besucht:

• BRB Banknet
• Banco Bradesco S.A.
• Banco Santander S.A.
• Banco do Brasil S.A.
• Banrisul
• Caixa Economica Federal S.A.
• HSBC BANK BRASIL S.A.
• HSBC InternetBanking
• Itau Bankline
• http://authmail.ibest.com.br/Autenticacao/autenticacao
• http://authmail.ig.com.br/Autenticacao/autenticacao
• http://webmail.globo.com/LoginWebmail/autenticarUsuario.ssp
• http://www.bancobva.com.br/areas/publico/pagp/default.asp
• http://www.bancofator.com.br/far/minhaconta.aspx
• http://www.bancopaulista.com.br/PaulistaHB/Default.asp
• http://www.bep.com.br/IBanking/principal.php?a=login
• http://www.besc.com.br
• http://www.besinvestimento.com.br/Default.aspx
• http://www.caixa.gov.br/#
• http://www.caixa.gov.br/_newredirect
• http://www.fininvest.com.br
• http://www.fininvest.com.br/hom/index.asp
• http://www.itauprivatebank.com.br/privatebank/index.htm
• http://www.mclass.com.br/scripts/mclass.dll/
• http://www.santander.com.br/
• http://www.spc.com.br/si/servlet/hlogin
• http://www2.paranabanco.com.br/Franquia/Franqueado.aspx
• https://bankline.itau.com.br/
• https://bankline.itau.com.br/GRIPNET/bklcom.dll
• https://bankline.itau.com.br/GRIPNET/gracgi.exe
• https://bankline.itau.com.br/lgnet/cartonista/bankline.htm
• https://bankline.itau.com.br/lgnet/itauf/bankline.htm
• https://banklineplus.itau.com.br/GRIPNET/bklcgi.exe
• https://banknet.brb.com.br/iBanking/
• https://bcadirecto.bca.cv/
• https://bcadirectoempresas.bca.cv/
• https://binanet.bi.cv/Login.asp
• https://binanetempresas.bi.cv/Login.asp
• https://br.credit-suisse.com/Default.aspx
• https://caixanetparticulares.caixa.cv/Login.asp
• https://carrinho.americanas.com.br/portal/acom.portal?_nfpb=true&
• https://carrinho.americanas.com.br/portal/acom.portal?_nfpb=true&portlet_payment_actionOverride=%2Fportlets%2Fpayment%2FchoosePaymentMethodAction&_windowLabel=portlet_payment
• https://carrinho.americanas.com.br/portal/meuCadastro.portal?_nfpb=true&LoginControllerPortlet_actionOverride=%2Fportlets%2Fcustomer%2Flogin%2FenderecoPesquisarPorCep&_windowLabel=LoginControllerPortlet
• https://carrinho.shoptime.com.br/portal/shoptime.portal?_nfpb=true&portlet_payment_actionOverride=%2Fportlets%2Fpayment%2FcreditCardValidateAction&_windowLabel=portlet_payment
• https://chaseonline.chase.com/online/AgentFCCServlet
• https://conexao.fininvest.com.br
• https://conexao.fininvest.com.br/index.asp
• https://consulta.equifax.com.br/menu.asp
• https://ibk.banparanet.com.br/ibban/htm/pj_acesso.htm
• https://ibpf.unibanco.com.br/unicard/
• https://internetbanking.caixa.gov.br/
• https://internetbanking.caixa.gov.br/SIIBC/siwinCtrl
• https://itaubankline.itau.com.br/
• https://itaubankline.itau.com.br/GRIPNET/bklcom.dll
• https://login.live.com/ppsecure/post.srf?
• https://nel.bnb.gov.br/
• https://netbanking.brp.com.br/NetBanking/c_brp.asp?acao=Logon
• https://netbanking2.banespa.com.br/
• https://portal.credicardciti.com.br/wps/ControllerBaseServlet
• https://segura.besc.com.br/cwsasp/cwsn.asp
• https://segura.besc.com.br/cwsasp/cwsn.asp/
• https://servicos.fininvest.com.br
• https://servicos.spc.org.br/pls/spc9765/spcindex.html
• https://servicos.spc.org.br/spc/controleacesso/autenticacao/passphrase.action
• https://sitenet.serasa.com.br/Logon/Logon
• https://smail-mia.terra.com.br/atmail.php?ret
• https://smail.terra.com.br/atmail.php?ret
• https://smu.jpmorgan.com/siteminderagent/forms/smu/gcp/login.fcc?
• https://wealth.goldman.com/login/login_b.cgi
• https://webid2.gs.com/cgi-bin/external/authenticate.cgi
• https://ww8.banrisul.com.br/brb/default.htm
• https://ww8.banrisul.com.br/brb/link/BrbwE0hw_MsgDialog.aspx
• https://www.bancogmac.com.br/homebank/logon.do
• https://www.bbmnetbanking.com.br/evhtml.cgi?FrmNumConta
• https://www.ccfacil.com.br/Login.asp?
• https://www.edivan.com.br/CtrlAcesso_geral.asp
• https://www.extra.com.br/Pagamento/infoComplementarFormaPagamento.aspx
• https://www.febraban.org.br/default.asp
• https://www.fs.ml.com/login/Login.asp?site=MLOL
• https://www.google.com/accounts/ServiceLoginAuth?service=
• https://www.indusval.com.br/tbib/ib_MICROSOFT.php
• https://www.intlmlol.ml.com/logon/logon.exe
• https://www.latinamerica.citibank.com/BRGCB/JSO/signon/ProcessUsernameSignon.do
• https://www.latinamerica.citibank.com/BRGCB/LATAM/common/AccountInfo.do
• https://www.latinamerica.citibank.com/BRGCB/jba/mp6/SubmitRecap.do
• https://www.magazineluiza.com.br/Seguro/caixa/ins_caixa.asp
• https://www.opportunity.com.br/Servicos/Login.aspx?
• https://www.paodeacucar.com.br/pagamento/processaFechamento.asp
• https://www.pontofrio.com.br/cgi-bin/loja_segura.pl
• https://www.prospertrade.com.br/acesso_cliente.asp
• https://www.santandernet.com.br/EfetuarLogin_Intermediaria_New.asp
• https://www.santandernet.com.br/IBPF/Home.asp
• https://www.santandernet.com.br/IBPF/LoginEscolhaUsuarios.asp
• https://www.santandernet.com.br/IBPF/transacoes/MPS/mps_WinXP.asp
• https://www.santandernet.com.br/IBPF/transacoes/MPS/mps_WinXpInf.asp
• https://www.santandernet.com.br/IBPF_Logout.asp
• https://www.santandernet.com.br/default.asp?txtAgencia=
• https://www.santandernet.com.br/logout.asp?oG=u&oA=site
• https://www.santandernet.com.br/paginas/CRM/Processa.asp
• https://www.tam.com.br/b2c/jsp/EfetuarPagamentoCCredito.jhtml
• https://www.tribancoonline.com.br/tribancoib/servlet/SvLogin
• https://www2.abcbrasil.com.br/ABCBanking/acesso/Login.aspx
• https://www2.bancobrasil.com.br/aapf/login.jsp?aapf.IDH=sim
• https://www2.bancobrasil.com.br/aapf/login.jsp?aapf.IDH=sim&perfil=1
• https://www2.bnpparibas.com.br/psso/WAgent.dll?Login0
• https://www2.extra.com.br/Usuario/Cadastro.aspx?userType=F&ReturnUrl=https://www2.extra.com.br/Pagamento/ListaEnderecos.aspx?Next=Pagamento.aspx
• https://www2.infoseg.gov.br/infoseg/do/TecladoVirtualAction
• https://www2.rural.com.br/RuralIBank/principal.jsp
• https://www2.rural.com.br/RuralIBank/validaLogin.jsp
• https://www2.rural.com.br/RuralIBank/validaSenha.jsp
• https://www2.submarino.com.br/Payment.aspx
• https://wwws.alfanet.com.br/Transacional/rdr_validacao.asp?
• https://wwws.bancoamazonia.com.br/prelogin.asp?
• https://wwws.banese.com.br/netbanking
• https://wwws.banese.com.br/netbanking/servlet
• https://wwws.banese.com.br/netbanking/servlet/Conf
• https://wwws.banese.com.br/netbanking/servlet/ConsDocEletronico
• https://wwws.banese.com.br/netbanking/servlet/ConsPagtoConv
• https://wwws.banese.com.br/netbanking/servlet/Login
• https://wwws.banestes.com.br/cgi-bin/Login
• https://wwws.gravames.com.br/gravames/
• https://wwws.nossacaixa.com.br/CarregarConta.asp
• https://wwws.nossacaixa.com.br/bemvindo.asp
• https://wwws2.hsbc.com.br/
• https://wwws3.hsbc.com.br/
• https://wwws3.hsbc.com.br/HOB-MEUHSBC/servlets/LoginMeuHSBC
• https://wwws3.hsbc.com.br/HOB-MEUHSBC/servlets/LoginMeuHSBC?CPF=
• https://wwws3.hsbc.com.br/HOB-MEUHSBCAPP/servlets/RedirectMeuHSBC?fin=0&trans=MHERF01&ServletState=50&LinkExecucao=/HOB-CCORRENTE
• https://wwws3.hsbc.com.br/HOB-MEUHSBCAPP/servlets/ServletMeuHSBC?ServletState=0
• https://wwws3.hsbc.com.br/HOB-MEUHSBCAUX/servlets/LogoutMeuHSBC?urlRedirect=/HOB/logincrm/meuhsbc/logout.html?
• https://wwws5.hsbc.com.br/
• https://wwwss.bradesco.com.br/scripts/ib2k1.dll/LOGIN
• https://wwwss.bradesco.com.br/scripts/ib2k1.dll/TAC/ENTRADASENHA?CTL
• https://wwwss.bradesco.com.br/scripts/ib2k1.dll/TAC/VRFSENHAATUAL

Der gefälschte Anmeldebereich überlappt den rechtmäßigen Anmeldebereich der Website, so dass er von Benutzern für einen Teil des IE-Fensters gehalten wird. Die gefälschte Anmeldeseite befindet sind in einem festen Bereich der rechtmäßigen Website. Dadurch gibt der derart getäuschte Benutzer vertrauliche Kontodaten preis. Die Tastenanschläge, die der Benutzer in den Feldern für Benutzername und Kennwort auf der gefälschten Anmeldeseite eingibt, werden protokolliert.

Versucht, Daten von den folgenden Banken und/oder anderen Geldinstituten zu entwenden:

• Alfa Net
• BCA Directo
• BES Investimento
• BESC
• BNP Paribas
• BRB Banknet
• Banco ABC Brasil
• Banco BBM
• Banco BVA
• Banco Bradesco
• Banco Fator
• Banco GMAC
• Banco Indusval
• Banco Interatlântico
• Banco Itau
• Banco Paulista
• Banco Rural
• Banco Santander
• Banco da Amazônia
• Banco do Brasil
• Banese
• Banespa
• Banestes
• Banparanet
• Banrisul
• Caixa
• Caixa Economica Federal
• Chase
• Citibank
• Credicard Citi
• Credit Suisse
• EDIVAN
• Equifax
• Federação Brasileira de Bancos
• Fininvest
• Goldman
• HSBC
• INFOSEG
• JP Morgan
• Magazine Luiza
• Nossa Caixa
• PontoFrio
• Prosperatrade
• Pão de Açúcar
• Serasa
• Tribanco
• Unibanco

Einschleusungspunkte

Versendet die gesammelten Daten an die folgenden E-Mail-Adressen:

• {BLOCKED}ed@uol.com.br
• {BLOCKED}na.fm@terra.com.br
• {BLOCKED}noschuch@terra.com.br
• {BLOCKED}ia-araujo@uol.com.br
• {BLOCKED}@oticasopcao.com
• {BLOCKED}00000001@hotmail.com.br
• {BLOCKED}00000002@hotmail.com.br
• {BLOCKED}00000003@hotmail.com.br
• {BLOCKED}piedade@oticasopcao.com
• {BLOCKED}io@oticasopcao.com
• {BLOCKED}n@oticasopcao.com
• {BLOCKED}@oticasopcao.com
• {BLOCKED}@oticasopcao.com
• {BLOCKED}lessa@terra.com.br
• {BLOCKED}afrigo@terra.com.br
• {BLOCKED}filho@terra.com.br
• {BLOCKED}@oticasopcao.com
• {BLOCKED}ldo@utranet.com.br
• {BLOCKED}a@oticasopcao.com
• {BLOCKED}@oticasopcao.com
• {BLOCKED}e@oticasopcao.com
• {BLOCKED}carara@terra.com.br
• {BLOCKED}olesta@terra.com.br
• {BLOCKED}e@oticasopcao.com
• {BLOCKED}@terra.com.br
• {BLOCKED}machiness@gmail.com
• {BLOCKED}dolfo@terra.com.br
• {BLOCKED}im@oticasopcao.com
• {BLOCKED}oticasopcao.com
• {BLOCKED}ro@oticasopcao.com
• {BLOCKED}@oticasopcao.com
• {BLOCKED}ne@oticasopcao.com
• {BLOCKED}arasantos@oticasopcao.com
• {BLOCKED}da@oticasopcao.com
• {BLOCKED}@oticasopcao.com
• {BLOCKED}oticasopcao.com
• {BLOCKED}aoliveira@oticasopcao.com
• {BLOCKED}na@oticasopcao.com
• {BLOCKED}i026@terra.com.br
• {BLOCKED}@terra.com.br
• {BLOCKED}ssc@oticasopcao.com
• {BLOCKED}s@oticasopcao.com
• {BLOCKED}roberto@oticasopcao.com
• {BLOCKED}cao@oticasopcao.com
• {BLOCKED}eis@oticasopcao.com
• {BLOCKED}o@oticasopcao.com
• {BLOCKED}ne@oticasopcao.com
• {BLOCKED}l@oticasopcao.com
• {BLOCKED}terra.com.br
• {BLOCKED}o.rh@oticasopcao.com
• {BLOCKED}o@oticasopcao.com
• {BLOCKED}r@oticasopcao.com

Informationen über Varianten

Verfügt über folgende MD5-Hash-Werte:

• 57b84dbf1e32261afab3827bbe6f2d57

Verfügt über folgende SHA1-Hash-Werte:

• c097986fda09dbfd75b3ab47d105cb5614ad7bc6