Nasty banking Trojan heralds new wave of smarter crimeware

URLzone Trojan software rewrites bank pages so that victims don't know their accounts have been emptied; it also spots investigators and sends them bad info

A sophisticated Trojan horse program designed to empty bank accounts has a new trick up its sleeve: It lies to investigators about where the money is going.

First uncovered by Finjan Software last week, the URLzone Trojan is already known to be very advanced. It rewrites bank pages so that the victims don't know that their accounts have been emptied, and it has a sophisticated command-and-control interface that lets the bad guys preset what percentage of the account balance they want to clear out.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

But Finjan isn't the only company looking into URLzone. RSA Security researchers say the software uses several techniques to spot machines that are run by investigators and law enforcement. Researchers typically create their own programs that are designed to mimic the behavior of real Trojans. When URLzone identifies one of these, it sends it bogus information, according to Aviv Raff, RSA's FraudAction research lab manager.

Security experts have long published research into the inner workings of malicious computer programs such as URLzone, Raff said. "Now the other side knows that they are being watched and they're acting," he said.

When URLzone spots a researcher's program, instead of simply disconnecting from the researcher's computer, the server tells it to do a money transfer. But instead of transferring the money into one of the criminal's money mules -- people who have been recruited to move cash overseas -- it chooses an innocent victim. Typically, these are people who have received legitimate money transfers from other hacked computers on the network, Raff said.

So far, more than 400 legitimate accounts have been used in this way, RSA said.

The idea is to confuse researchers and to prevent the criminal's real money mules from being discovered.

Banking Trojans such as Zeus and Clampi have been emptying accounts for years now, but Finjan dubbed URLzone the first of a new, smarter generation of the crimeware.

According to Finjan, URLzone infected about 6,400 computer users last month and was clearing about €12,000 ($17,500) per day.