New Variant of Shylock Banking Malware Spread via Skype

Triple Helix · Jan 21, 2013

Monday, January 21, 2013
The news is very concerning, a new variant of the banking malware known as Shylock has been detected, it includes the capability to spread over Skype.
Shylock is an old acquaintance for security community, the malware was detected for first time in 2011 by experts from Trustee firm, it is used to steal banking credentials from its victims and is considered one of the most insidious cyber threat for banking.
The first version of the malware demonstrated improved methodology for injecting code into browser to remote control the victim and an improved evasion technique to prevent detection by common antivirus software.
Curiously, the origin of the name for the malware, Shylock is the money lender in Shakespeare's opera The Merchant of Venice.
As many other malware (e.g. Zeus) it has been update in the time, in many cases the provisioning of a malware has been done through the malware-as-service model in adopted by author to implement various requests of the clients.
The news has been published by researchers from CSIS Security Group, that revealed that that the authors of malware have implemented a plugin named "msg.gsm" that allows the code to spread through the popular VOIP client including the following functionality:

Sending messages and transferring files

Clean messages and transfers from Skype history (using sql-lite access to Skype%smain.db )

Bypass Skype warning/restriction for connecting to Skype (using “findwindow” and “postmessage”)

Sends request to server: https://a[removed]s.su/tool/skype.php?action=...

Click to expand...

Full Article

TH

Frank the Perv · Jan 21, 2013

Thanks TH.

Triple Helix · Jan 22, 2013

Your Welcome.

TH

pajenn · Jan 22, 2013

2 questions:

1. Does this only affect Skype on Windows, or are android, iOS, linux systems with skype also at risk?

2. What security measures should I take against this? (fwiw, my adroid phone doesn't have AV or firewall on it because it's low end so I can't afford the resource hit on it).

Carver · Jan 22, 2013

What version/s of Skype, version 6.1.0.129, or previous.

Triple Helix · Jan 22, 2013

I don't think it matters:

You would need to accept a file transfer or click on a link. Just as with email or other chat clients, you should avoid downloading files or clicking links that are unsolicited or unexpected. If the file or link came from someone you know, ask them if they knowingly sent it, and if they did not they may be infected.

-Dan
Webroot Threat Research
Click to expand...

http://community.webroot.com/t5/Sec...nking-Malware-Spread-via-Skype/m-p/22790#M875

TH

Log in or Sign up

New Variant of Shylock Banking Malware Spread via Skype

Triple Helix Specialist

Frank the Perv Banned

Triple Helix Specialist

pajenn Registered Member

Carver Registered Member

Triple Helix Specialist

Log in or Sign up

New Variant of Shylock Banking Malware Spread via Skype

Triple Helix Specialist

Frank the Perv Banned

Triple Helix Specialist

pajenn Registered Member

Carver Registered Member

Triple Helix Specialist

Useful Searches