A new banking trojan that aims to gather financial information and data has been detected by security researchers on computers in Japan. The malware creates a malicious proxy server on the victim's computer and filters all IP addresses except those it targets.
Although the malware relies on basic methods of changing proxy server settings to direct victims to fake Japanese bank websites, it uses sophisticated social engineering techniques to achieve this goal
Security researchers at IBM Trusteer analyzed the piece of malware and took the name they gave it from the city of Tsukuba, Japan.
They observed that the distribution method for the banking Trojan is via spam mail, and once it is installed and infects the computer, it runs a set of actions designed to hide the malicious activity, the purpose of which is to steal orders and personal information, making the victim believe that they are on an official and secure website.
The banking trojan hides its installation, contains defenses to detect its presence on the system, and only runs if the proxy detection tools are not working on the infected computer. In addition, it can determine from the beginning of its installation whether the victim matches its list of targets.
After installing the fake certificate, which is appended with a legitimate and official name, usually using "VeriSign Class 3 Public Primary Certification Authority – G5", it proceeds to change the proxy settings, which are applied to Internet Explorer, Mozilla Firefox and Google Chrome.
In the final stage of the attack, Tsukuba uses its connections to fake websites on the internet to get the information it wants from the victim.
Until now, Japan has been largely protected from such scams due to the country's unique language, but it seems that scammers are slowly overcoming this obstacle and are increasingly targeting Japanese users.
