Robbery in the AfterWorld

One-click Billing Fraud

Mobile
- Trending Scams Seen in the Android Market
- Malicious Mobile Apps Found in Server Hosted in Germany
- Fake Version of Temple Run Unearthed in the Android Market
- Search Monetization As a New Threat to the Mobile Platform
- One-Click Billing Fraud Scheme Through Android App Found
- 3 Truths about Mobile Applications
- How Big will the Android Malware Threat Be in 2012?
- 2011 in Review: Mobile Malware
- Checking the Legitimacy of Android Apps
- The Real Issues About Carrier IQ

February 2012
S	M	T	W	T	F	S
« Jan
	1	2	3	4
5	6	7	8	9	10	11
12	13	14	15	16	17	18
19	20	21	22	23	24	25
26	27	28	29

Malware Blog > Robbery in the AfterWorld

Jun11

6:35 am (UTC-7) | by Dianne Lagrimas (Technical Communications)

TROJ_BANLOAD.CZE is banking on the stir caused by an animated sci-fi series, currently hosted in YouTube, to cover its virtual robbery scheme. Similar to TROJ_BANLOAD.CFU, it also downloads TSPY_BANKER.JAT, a variant of a Trojan spyware family known for stealing online banking-related information. TROJ_BANLOAD.CZE opens an Internet Explorer window to connect to an episode from the animated series AfterWorld so as to hide its download routine:

This latest TROJ_BANLOAD iteration may be downloaded from certain Web pages. Users are advised to exercise vigilance and caution in downloading files.