Waledac malware returns after two years with password-stealing capabilities

A new version of the Waledac malware. capable of stealing passwords and BitCoins, has been detected in the wild

A new version of the Waledac malware has been spotted on the Internet, but unlike previous variants, which were mainly used for spamming purposes, this one steals various log-in credentials and BitCoins, a type of virtual currency.

"The sample was originally detected on Feb 2nd and the first coverage by a major AV was not observed until Feb 13th," researchers from network security firm Palo Alto Networks announced in a blog post on Tuesday.

The original Waledac botnet was one of the top spam sources on the Internet until it got shut down by Microsoft in cooperation with other security vendors in March 2010.

However, the new version's primary goal might no longer be spam, said Wade Williamson, a senior product manager at Palo Alto Networks. That's because it also steals FTP, POP3 and SMTP user passwords, as well as .dat files for BitCoin wallets.

This is the first time that Palo Alto Networks' firewall products have spotted Waledac-related activity since the original botnet was shut down two years ago, Williamson said.

The botnet's two-year inactivity was confirmed by antivirus firm BitDefender. "We have closely monitored the Web space during international events such as the deaths of political leaders and calamities – moments when the Waledac botnet would run at peak capacity before the takedown and did not notice any malicious activity on that front," said BitDefender E-Threats Analyst Bogdan Botezatu.

It's difficult to determine with certainty if the new version is the creation of the original Waledac authors, but its high similarity to the old variant suggests that it is the work of someone with access to the original source code, Williamson said.

"What it is sure is the fact that the newly added functionalities (email and FTP credentials harvesting) will contribute to an explosive development of the new botnet," Botezatu said. "FTP accounts will likely be used to accommodate binary copies of the bots, while the e-mail accounts will be used to propagate spam through not-yet-blacklisted mail servers."

Palo Alto Networks researchers have determined that the new Waledac version is being distributed through Web sessions, probably with the help of exploits hosted on compromised websites. According to Botezatu, BitDefender is also investigating this possibility.

"We recommend users to deploy and update a security solution with antispam and antivirus modules," Botezatu said. "We also advise that users rely on SFTP and SSL when connecting to FTP and mail servers, respectively, in order to minimize the risk of network sniffing."

Join the PC World newsletter!

Error: Please check your email address.

Struggling for Christmas presents this year? Check out our Christmas Gift Guide for some top tech suggestions and more.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?