Warnung vor URLZone Trojan

By analysing the configuration file, one can see the full scale of how malicious URLZone Trojan really
is. Among other things, it is exposed that URLZone can:
· recognize a particular financial institution
· recognize a particular stage of the internet banking session (e.g. login, account statement,
wire transfer etc)
· recognize and save HTTP(s) parameters for later use
· change any HTTP(s) parameters in any GET or POST requests
· introduce arbitrary HTML into the page(s)
Now once an internet banking session is authenticated after the login (with the aid of 2-Factor
authentication in some instances), it’s easy to see that equipped with the above feature list,
URLZone can easily:
· steal pretty much any amount and use it straight away (for example URLZone will try to
recognize your daily wire transfer limit and will then automatically adjust the amount to be
transferred to the money mule so as to not raise suspicion)
· reveal pretty much any information from the account and/or user profile
· perform multiple wire transfers in the background
· manipulate any page (for example the account online statement page to offset any amounts
stolen)

Zum Vergrößern anklicken....

Like all major Trojans (Silentbanker, Zeus, Clampi etc), URLZone will hook key Windows functions of
Internet Explorer to its allocated memory region. In doing this, URLZone will gain access to all
internet requests (HTTP, HTTPS and EV-SSL HTTPS), which is needed for URLZone to do its dirty work.

Zum Vergrößern anklicken....