Security

Part virus, part botnet, spreading fast: Ramnit moves past Facebook passwords

Last Updated on Sunday, 08 April 2012 07:51 Published on Tuesday, 10 January 2012 13:23

The latest variant of Ramnit, the Windows malware responsible for the recent theft of at least 45,000 Facebook logins, is the latest example of how malware writers and cyber-criminals take "off-the-shelf" hacks and bolt them together to teach old viruses new tricks. Facebook passwords aren't the only thing that the Ramnit virus can grab—thanks to the integration of some of the code from the Zeus botnet trojan, Ramnit can now be customized with modules for all manners of remote-controlled mayhem.

"Ramnit is an interesting beast," said Amit Klein, CTO of web security services firm Trusteer in an interview with Ars. "Until last summer, it was just a generic worm spreading around by infecting files. Then they retrofitted it with financial fraud capabilities."

The evolved version of Ramnit is a potent threat to enterprises, he said, because it can capture any data in a web session—and as more companies move to web-based software as a service for enterprise applications, that could include almost anything.

First sighted by researchers in 2010 in its initial form, Ramnit spreads by attaching itself to Windows executable files (.EXE. .SCR and .DLL files) as well as to HTML documents. In some variants spotted earlier this year by Microsoft researchers, it also attached itself to Microsoft Office documents. Versions have also been spotted that install themselves onto USB drives when they're connected, and create an Autorun script that launches the virus' installer when the drive is plugged into another PC.

Ramnit infections exploded in the summer of 2011. According to a report from Symantec, Ramnit accounted for over 17 percent of the malware blocked by the company's antivirus software in July. Researchers at the security firm Seculert found through the installation of a "sinkhole" that between September and December of 2011, over 800,000 individual Windows PCs were infected with the virus and reporting back to a command and control network. [arstechnica]