Categories: MalwareWhat is

Vawtrak malware spread via toxic Word documents Beware poisoned parking tickets

Pernicious spam (malspam) utilizing Microsoft office records with Hancitor-based Visual Basic (VB) macros to send Pony and Vawtrak. Regardless it happens,And A report Said  this one from 2016-12-19, where Hancitor/Pony/Vawtrakmalspamwas disguised as a LogMeIn account notification ,And apparently, there’s been a recent lull in Hancitor/Pony/Vawtrakmalspam

Once Vawtrak infects a PC, it is capable of logging keystrokes, taking screenshots, and hijacking webcams. It also opens a remote access backdoor that allows anyone who controls it to steal files, digital certificates, and passwords from the victim’s computer..

It’s not as common as it once was, but malicious spam that infects users with the Pony and Vawtrak malware is still making its rounds in the wild.

what is Vawtrak

Vawtrak is an information stealing malware family that is primarily used to gain unauthorised access to bank accounts through online banking websites. Machines infected by Vawtrakform part of a botnet that collectively harvests login credentials for the online accounts to awide variety of financial and other industry organisations.

These stolen credentials are used,in combination with injected code and by proxying through the victim’s machine, to initiatefraudulent transfers to bank accounts controlled by the Vawtrak botnet administrators.

Brad Duncan ,Explained this In SANS blog,

” The link from the malspam downloaded a Microsoft Word document.  The document contains a malicious VB macro described has Hancitor, Chanitor or Tordal.  I generally call it Hancitor.  If you enable macros, the document retrieves a Pony downloader DLL.  The Pony downloader then retrieves and installs Vawtrak malware. “

On 10 January, Brad Duncan of the SANS Internet Storm Center received what appeared to be a parking ticket notification.

Flow chart of the infection process. source :SANS

Infection traffic after activating macros in the Word document.

Duncan conclude in his Article ,

we often become jaded as yet another wave of malspam does the same thing it’s done before.  Patterns behind such activity are often well-documented. hat attitude only encourages the criminal groups behind malspam.

For various reasons, many environments don’t follow best security practices, and they’re still vulnerable.  If we discuss on-going waves of malspam in high-visibility forums like this one, more people will be aware of the threat.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

View Comments

Recent Posts

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…

5 hours ago

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…

6 hours ago

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…

6 hours ago

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…

6 hours ago

New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine

A security researcher discovered a vulnerability in Windows theme files in the previous year, which…

6 hours ago

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…

6 hours ago