Q
Manage Learn to apply best practices and optimize your operations.

Kronos banking Trojan: How does the new variant compare?

Proofpoint researchers found a Kronos variant after it targeted victims in Germany, Japan and Poland. Learn how this variant compares to the original banking Trojan with Nick Lewis.

The Kronos banking Trojan is back after several years, as Proofpoint Inc. researchers found it targeting victims...

in Germany, Japan and Poland. How did researchers tie this new variant to the original Kronos, and what's different about the latest version?

In order to stay one step ahead of antimalware researchers, malware authors must continue to update their malware. This means malware authors must continue developing their attacks to add new capabilities to bypass advancing security controls. After largely being dormant for several years, a variant of the Kronos banking Trojan has recently returned with new functionality.

The updated Kronos banking Trojan was found targeting German, Japanese and Polish users with malicious attachments in the users' native languages that were sent in phishing emails with subject lines intended to attract attention. The malicious attachment was a Word document with macros that downloaded and executed the new Kronos banking Trojan. One of the campaigns used malvertising with malicious JavaScript that redirected the victim to an exploit kit to eventually upload the Kronos banking Trojan.

Proofpoint reported that Kronos "is a banking Trojan that uses man-in-the-browser techniques along with webinject rules to modify the web pages of financial institutions, facilitating the theft of user credentials, account information, other user information, and money through fraudulent transactions. It also has keylogging and hidden VNC [Virtual Network Computing] functionality to help with its 'banker' activities."

With the updated Kronos banking Trojan, attackers use Tor as a command-and-control mechanism to make it more difficult to take down the attacker's network. While Kronos may have been rebranded as Osiris, the updated malware has extensive similarities to previous versions, including its use of the same Windows APIs, string encryption, C&C format -- although, in this attack, it was used in Tor -- WebInject format and a similar C&C panel format.

However, antimalware detections don't depend on the name of the malware, and detection is based on the functionality or signatures.

Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)

This was last published in December 2018

Dig Deeper on Malware, virus, Trojan and spyware protection and removal

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

How did the Kronos variant affect your enterprise?
Cancel

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly.com

Close