Bitdefender Identified New Instant Messaging Trojan

Security researchers of security firm Bitdefender have warned users of a new instant messaging Trojan known as Gen:Variant.Downloader.167 which has infected hundreds of computers all over the world.

The new Trojan comes as a message from a friend inviting the recipient to see pictures which contain malicious code.

The messages consist links of popular file sharing services like Dropbox and Fileswap giving it an authentic look.

Once installed, the malware sends more messages and in the process spread the scam and compromised systems with more Windows malware.

Theregister.com published news on 27th May, 2014 quoting an explanation by Catalin Cosoi, Chief Security Strategist of Bitdefender, as "Gen:Variant.downlooader.167 gains access to contact list of the user and spreads itself through instant messaging of Facebook and Yahoo Messenger from one friend to another. Moreover, Trojan is superbly polite using biblical verses to decrypt keys for its data."

Security researchers find the usage of biblical verses in malware a new scheme and they don't know the meaning of it as yet but they are trying to get to the root of it.

Actually, the Trojan aims to make money by reselling sensitive data as when Trojan is downloaded on the machine, it searches for a command and control center to further download malware and finally send confidential data like banking credentials, usernames and passwords to attackers.

Bitdefender says that a maximum infection has been observed in Romania, Germany and Canada along with United States, United Kingdom, France and Denmark.

Hence, Bitdefender advises you to totally ignore any message you receive from a friend on Facebook or Yahoo which asks you to download and see photos or at least use a reliable file scanner to check malware before downloading the photos. And to avoid infection in the initial stage itself, users advised to install anti-virus software on their computers.

Similar malware infected thousands of users of Facebook worldwide during March 2013 as the malware, namely Dorkbot, posed as "jpg" image but it was actually an executable file which could spy browser activities and steal personal data. Similar scam promising naked videos of Facebook friends appeared during March 2014 but it was actually Trojan malware.

» SPAMfighter News - 6/6/2014