Security firm Proofpoint has discovered a new form of malware that costs just $7 and has the ability to evade detection by antivirus software.
After an in-depth analysis of the malware, Proofpoint explains that Ovidiy Stealer costs from 450 to 750 rubles (i.e. from 7 to 13 USD), and includes a precompiled executable file.
The company states that the file is encrypted to "prevent analysis and detection," and while the infection can be detected by some antivirus solutions, it is listed with a generic description that says little about the malware's purpose.
Ovidiy Stealer is commonly spread via executable email attachments, compressed executable attachments, and links leading to crack and keygen websites. In all cases, the included file is an executable file containing the malware.
The malware targets many popular software solutions, including Google Chrome, Opera browser, Filezilla, and Torch browser.
“We have observed that versions from 1.0.1 to 1.0.5 are being released. Ovidiy Stealer is written in .NET and most of its samples are packaged with either the .NET Reactor application or Confuser. When executed, the malware remains in the folder where it was installed and where it will start executing all its processes. The strange thing is, there is no mechanism to restart it on reboot. So after the system is shut down, the malware will stop running, but the folder will remain on the system,” says Proofpoint.
Once it infects a machine, the malware uses SSL/TLS connections to communicate with a command and control server and looks for passwords in the applications listed above to hand over to the hackers. It sends information such as the processor ID, the website with the stored credentials, targeted applications, username and passwords.
Many updated samples of malware have already been detected online, so updating the security software you use and always double-checking before downloading files from untrusted sources seem to be the two best ways to stay protected.
