Windows Activator Bundles Banker with C2 in YouTube Description

guest · Oct 3, 2019

Windows Activator Bundles Banker with C2 in YouTube Description
October 3, 2019
https://www.bleepingcomputer.com/ne...undles-banker-with-c2-in-youtube-description/

In their effort to hide the command and control (C2) server addresses, operators of a banking trojan placed them in fake websites and in descriptions for YouTube videos.
The name of the malware is Casbaneiro and its wide distribution is possible through ReLoader, an illegal activation tool to create pirated versions of the Windows operating system and Microsoft's Office suite.
C2 address snuck in online resources
The banker is not new in the business, being the sixth most prevalent banking trojan in Latin America earlier this year. It was also observed in various campaigns by researchers at FireEye, Cisco, and enSilo.
Malware analysts from ESET also found strong connections between Casbaneiro and another banking trojan called Amavaldo.

Placed at the end of the video description, the address of a Casbaneiro C2 server is disguised as a link to a Facebook or Instagram page. These are fake, though, as their role is simply to store the domain name in encrypted form.
Click to expand...

ESET: Casbaneiro: Dangerous cooking with a secret ingredient

Log in or Sign up

Windows Activator Bundles Banker with C2 in YouTube Description

guest Guest

Log in or Sign up

Windows Activator Bundles Banker with C2 in YouTube Description

guest Guest

Useful Searches