SpyEye Banking Trojan. - SecNiche Security Labs

More documents

Recommendations

Info

SpyEye Bot Infection Framework Builder Main Admin Form Grabber Admin Backend Collector
SpyEye Builder – Specific Details Builds the configuration file and bot for spreading infections. The configuration parameters are automatically threaded in the bot itself. Builder cannot be allowed to run directly. It uses VMprotect +HWID+ custom protections in general. Cracked versions usually have UPX + ASPACK 2.12 Builder uses Import Address Table (IAT) to build dropper. API’s are rarely used in the build process. Bot uses inbuilt application and low level API’s. Possible to pack dropper with UPX Library to attain more optimization. Reduce size for faster downloading of SpyEye bot. Uses encryption key to maintain the integrity of configuration file. Inside Builder !
Page 1 and 2: Eye for an Eye SpyEye Banking Troja
Page 3 and 4: About Me Founder , SecNiche Securit
Page 5 and 6: Problem
Page 7 and 8: SpyEye Released Analysis - Relative
Page 9: Design
Page 13 and 14: Generic HWID - One Machine License
Page 15 and 16: SpyEye - Main Admin Admin panel pro
Page 17 and 18: Backend Collector SpyEye database s
Page 19 and 20: Trade and Tactics
Page 21 and 22: Tampering Browser Activity
Page 23 and 24: Web Browser Injects Injecting malic
Page 25 and 26: Web Fakes DLL - Pseudo Code
Page 27 and 28: Malicious Plugin Generation - Pseud
Page 29 and 30: Questions ??

SpyEye Banking Trojan. - SecNiche Security Labs

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?