Trojan program ‘Neverquest’ a new threat to online banking users, researchers say
Attackers could start to aggressively distribute this malware in the near future, Kaspersky Lab researchers warn
By Lucian Constantin
News.TechWorld.com
November 2013
Facebook8Twitter3LinkedIn2Google Plus0Share This18
Article comments
A new Trojan program that targets users of online financial services has the potential to spread very quickly over the next few months, security researchers warn.
The malware was first advertised on a private cybercrime forum in July, according to malware researchers from Kaspersky Lab who dubbed it Trojan-Banker.Win32/64.Neverquest.
“By mid-November Kaspersky Lab had recorded several thousand attempted Neverquest infections all around the world,” said Sergey Golovanov, malware researcher at Kaspersky Lab, Tuesday in a blog post. “This threat is relatively new, and cybercriminals still aren’t using it to its full capacity. In light of Neverquest’s self-replication capabilities, the number of users attacked could increase considerably over a short period of time.”
Neverquest has most of the features found in other financial malware. It can modify the content of websites opened inside Internet Explorer or Firefox and inject rogue forms into them, it can steal the username and passwords entered by victims on those websites and allow attackers to control infected computers remotely using VNC (Virtual Network Computing).
However, this Trojan program also has some features that make it stand out.
Its default configuration defines 28 targeted websites that belong to large international banks as well as popular online payment services. However, in addition to these predefined sites, the malware identifies Web pages visited by victims that contain certain keywords such as balance, checking account and account summary, and sends their content back to the attackers.
This helps attackers identify new financial websites to target and build scripts for the malware to interact with them.
The Rest…HERE
