The Trojan accesses the following URLs for configuration and incoming and outgoing updates. Customers are advised to block egress access to these domains since any traffic bound for these sites would clearly indicate an infection with 'Trojan.Silentbanker’.
iloveie.info
webcounterstat.info
microcbs.com
reservaza.com
screensaversfor-fun.com
mystabcounter.info
85.255.119.218
The Trojan also installs a copy of Trojan.Flush.J, which changes the user's DNS settings to the following malicious resolvers:
85.255.116.133
85.255.112.87
MIRT Hunter Premium Member Joined: May 19, 2007 Posts: 624 Location: USA
Posted: Wed Jan 16, 2008 1:16 am Post subject:
We've had copies of this for about two weeks.
(that was put on our listserv)
Symantec just got around to finally fully analyzing what it does.
I took a run with it on my virtual machine and have to say that the symantec report is pretty thorough. I dont know what more information you would need.
While this is a nasty one because of the way it hides and steals data, I doubt its very widespread.
I am curious about how or from where it spreads, havent figured that out yet.
You can post new topics in this forum You can reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You cannot download files in this forum