This "New" Windows Malware called "Beta Bot". Reminds me of a few from Win98 and XP in the Past. And it sounds just as Dangerous. Read More...

Don

Beta Bot malware blocks users anti-virus programs

The FBI is aware of a new type of malware known as Beta Bot. Cyber criminals use Beta Bot to target financial institutions, e-commerce sites, online payment platforms, and social networking sites to steal sensitive data such as log-in credentials and financial information. Beta Bot blocks computer users’ access to security websites and disables anti-virus programs, leaving computers vulnerable to compromise.

Beta Bot infection vectors include an illegitimate but official looking Microsoft Windows message box named “User Account Control” that requests a user’s permission to allow the “Windows Command Processor” to modify the user’s computer settings. If the user complies with the request, the hackers are able to exfiltrate data from the computer. Beta Bot is also spread via USB thumb drives or online via Skype, where it redirects the user to compromised websites.

*
Figure 1, Beta Bot “Windows Command Process” message box

Read More...
http://www.ic3.gov/media/2013/130918.aspx

The FBI’s Internet Crime Complaint Center (IC3) has published an alert to warn users about a relatively new piece of malware dubbed Beta Bot. Beta Bot is mainly used by cybercriminals to steal personal and financial information. Social media sites, e-commerce sites, banks and online payment platforms are the main targets.

What’s interesting about this threat is that it’s designed to disable antivirus applications, and block users from accessing security websites that might help them clean up the infection.

Beta Bot is distributed via various methods, including USB drives or via Skype (users are redirected to malicious websites). The infection can start with a legitimate-looking fake User Account Control window which requests permission to allow “Windows Command Processor” to make changes to the system. If the victim complies, the attackers gain access to their system.

The FBI advises users not to authorize Windows Command Processor to make any changes to the system in case they see a pop-up window such as the one presented in the screenshot.
Red More...
http://news.softpedia.com/news/FBI-Warns-of-Beta-Bot-Malware-384815.shtml

29May

New Commercial Trojan #INTH3WILD: Meet Beta Bot

Tags: #INTH3WILD, Beta Bot, Cybercrime and Fraud, trojan

Categories: #inth3wild,Fraud Intelligence,FraudAction

By Limor S. Kessem, Cybercrime and Online Fraud Communications Specialist, RSA

It appears that a much anticipated event has finally transpired in the cybercrime arena, with the release and active sale of a new commercially-available Trojan family that has begun around January this year, circulating under the name Beta Bot.

RSA researchers have recently come across samples of this user-mode rootkit, analyzing its behind-the-scenes infrastructure. Beta Bot actually started out as an HTTP bot[1] and not a banking Trojan, but it has since evolved, donned a trigger list, and was repurposed for financial fraud that includes targets such as banks, ecommerce and even Bitcoin wallets.

According to research performed by RSA it was inferred that Beta Bot (alias: Troj/Neurevt-A) is not the creation of an amateur. The malware is a persistent Ring-3 rootkit with layers of anti-security protection (such as not executing within virtual machines, thus avoiding sandboxes), AV-disabling features, and even a DNS redirecting scheme to isolate bots from security-themed online resources, including RSA’s official website.

Examining the Features of Beta Bot