Valentine's day infection dissected

According to Corrons, like many malware infections, Love.exe relies on users clicking on the executable and triggering an infection of the host computer.

When you run the executable, he says, the most interesting aspect of the malware is that nothing visible appears to happen.

This is because the code is a remote access trojan, or RAT, and allows hackers to gain remote access to your computer and its data.

Corrons reports that the malware supports a variety of remote access facilities, including a remote desktop, webcam and audio streaming, remote passwords, an MSN sniffer, a remote shell, and an offline (and online) keylogger.

"You may think that the cybercriminals behind this are really smart", he said, adding that, whilst this could be, he does not think so, as to create a trojan like this costs just a few dollars for the toolkit.

The Panda technical director said that he played around with a similar toolkit back in 2008 and has posted a screenshot of his efforts in his security blog.

"As many years have passed nowadays it's really easy to find [these toolkits] for free", he said.

Yes, he went on to say, it really is very easy to code up this type of malware and, according to Panda's database, there are more than 395,000 samples of this type of trojan.

 

What’s hot on Infosecurity Magazine?