analysis of a banking trojan, currently in the wild, that targets banks in Brazil.
During our research, we found out that it updates regularly and uses various social engineering tricks to spread and infect computers. Various executable components are downloaded, each of them having specific actions, such as spreading the malware, stealing bank information, etc.
The techniques it uses to steal credentials are particularly interesting. One of them is the way it manages to bind fake dialogs from the executable into Internet Explorer, allowing it to "inject" a rogue window into the browser. Visitors will log in and their information will be stolen while the browser still shows the lock at the bottom of the browser. The certificate is still valid, of course, since everything is done on the client side.
This one tip will help you sleep better tonight
A few seconds are all you need to get a better night's rest.