Recently,Symantec researchers analyzed the notorious Flashback Trojan sample in order to find the cybercriminal's motivation for launching this malware attack.
According to Symantec researchers, the malware's ad-clicking component is loaded into Chrome, Firefox, and Safari where it can intercept all GET and POST requests from the browser.
According to Symantec researchers, the Flashback ad-clicking component is loaded into Chrome, Firefox, and Safari where it can intercept all GET and POST requests from the browser.
Flashback specifically targets search queries made on Google and, depending on the search query, may redirect users to another page of the attacker's choosing, where they receive revenue from the click . (Google never receives the intended ad click.)
"The ad click component parses out requests resulting from an ad click on Google Search and determines if it is on a whitelist. If not, it forwards the request to the malicious server," experts explained.
This request is specially crafted in order to thwart researchers' attempts to investigate the URL.
"Ad-clicking Trojans are nothing new and in an analysis of W32.Xpaj.B last August a botnet measuring in the region of 25,000 infections could generate the author up to $450 per day," point out the researchers.
"Considering the Flashback Trojan measures in the hundreds of thousands, this figure could sharply rise to the order of $10000 per day," they concluded.
According to Symantec researchers, the malware's ad-clicking component is loaded into Chrome, Firefox, and Safari where it can intercept all GET and POST requests from the browser.
According to Symantec researchers, the Flashback ad-clicking component is loaded into Chrome, Firefox, and Safari where it can intercept all GET and POST requests from the browser.
Flashback specifically targets search queries made on Google and, depending on the search query, may redirect users to another page of the attacker's choosing, where they receive revenue from the click . (Google never receives the intended ad click.)
"The ad click component parses out requests resulting from an ad click on Google Search and determines if it is on a whitelist. If not, it forwards the request to the malicious server," experts explained.
This request is specially crafted in order to thwart researchers' attempts to investigate the URL.
"Ad-clicking Trojans are nothing new and in an analysis of W32.Xpaj.B last August a botnet measuring in the region of 25,000 infections could generate the author up to $450 per day," point out the researchers.
"Considering the Flashback Trojan measures in the hundreds of thousands, this figure could sharply rise to the order of $10000 per day," they concluded.