New Brazilian Banking Trojans Alert

By Manoj Venugopalan, Malware Analyst, Symantec Hosted Services

Brazil is the biggest country in Latin America with a population of over 198.7m people, 34% of whom are connected to the internet. It is also a country with a low GDP per capita ratio and higher rates of criminality, especially relating to cyber crime.  With tens of millions of users already using online banking services in Brazil, cyber criminals find Internet banking an attractive target, particularly in the application of banking Trojans used to bypass two-factor authentication systems and other security countermeasures.
MessageLabs Intelligence has seen many Banker Trojan attacks in the past, however, more recently, I came across two different banks that were being targeted by one single attacker: Bradesco and Sicredi. MessageLabs Intelligence had been blocking the Bradesco banking attack some days ago, but then I noticed the Sicredi Bank attack on Saturday 20 February. It was early in the morning and none of the well-known anti-virus companies were detecting this malware, except for Symantec. See the full Virus Total report here:
 

The malware had been zipped and attached in emails sent to a number of Symantec Hosted Services clients.  Both forms of the attack used attached different files and had different subjects and sender information, in each case using spoofed email sender addresses that pretended to be official (continue reading...)