Another Massive ID theft ring



It looks like Sunbelt has found ANOTHER massive Identity theft ring. They suspect it’s a trojan from the Dumaru family that is contentedly logging the infromation and promise more details.


They did get a hold of the trojan and passed it through virustotal to see what it was. Very FEW antivirus vendors have definitions for it at this point. The file in question is winldra.exe
Here’s the summary they got.

This is a report processed by VirusTotal on 08/19/2005 at 23:45:42 (CET) after scanning the file “winldra.exe” file.
Antivirus Version Update Result
AntiVir 6.31.1.0 08.19.2005 no virus found
Avast 4.6.695.0 08.19.2005 no virus found
AVG 718 08.19.2005 no virus found
Avira 6.31.1.0 08.19.2005 no virus found
BitDefender 7.0 08.19.2005 no virus found
CAT-QuickHeal 7.03 08.19.2005 no virus found
ClamAV devel-20050725 08.18.2005 no virus found
DrWeb 4.32b 08.19.2005 no virus found
eTrust-Iris 7.1.194.0 08.18.2005 no virus found
eTrust-Vet 11.9.1.0 08.19.2005 Win32.Bambo
Fortinet 2.41.0.0 08.18.2005 suspicious
F-Prot 3.16c 08.19.2005 no virus found
Ikarus 0.2.59.0 08.19.2005 no virus found
Kaspersky 4.0.2.24 08.19.2005 no virus found
McAfee 4563 08.19.2005 BackDoor-CCT
NOD32v2 1.1198 08.19.2005 no virus found
Norman 5.70.10 08.18.2005 no virus found
Panda 8.02.00 08.19.2005 no virus found
Sophos 3.96.0 08.19.2005 no virus found
Sybari 7.5.1314 08.19.2005 no virus found
Symantec 8.0 08.19.2005 no virus found
TheHacker 5.8.2.091 08.18.2005 no virus found
VBA32 3.10.4 08.19.2005 suspected of Embedded.Backdoor.Win32.Dumador.dd

(It looks as though 3 of the antivirus vendors recognize this so far.)

They’re working with the vendors to get signature updates.

Related Posts

Blog Traffic Exchange Related Posts
  • Running UltraVNC viewer under wine I talked in the last entry about using UltraVNC and UltraVNC Single Click (ultravnc sc) as a means of doing remote desktop support. The idea is that you (the technical support person), setup vncviewer to listen for connections, then the end user with pc problems can download your customized ultravnc......
  • Disinfecting a PC... part 1 This is the first in a several part series documenting the cleaning of an infected PC. The only real noteworthy item is that it was a dial-up only connection and was rather infested for that. (On par with some of the broadband connected pc's I've seen. It's also an interesting......
  • New Beagle/Bagle variant? So, I submitted the suspicious attachment I received to virustotal (scan@virustotal.com with SCAN in the subject and suspicious file as attachment.) What follows below is the report I received. It looks like some of the big names (Symantec, McAfee are not finding anything wrong with it at this point, with......
Blog Traffic Exchange Related Websites
  • McMillan Speed Workouts based on 21:41 5k From McMillan Running Calculator: Speed Workouts Long Distance Runners 400m 1:35.2 to 1:40.7 - 9.44 mph to 8.93 mph 800m 3:18.9 to 3:28.2 - 9.04 mph to 8.64 mph 1200m 5:05.8 to 5:21.3 - 8.64 mph to 8.33 mph 1600m 6:56.4 to 7:11.7 - 8.64 mph to 8.33 mph I'm......
  • New Loan Funded — Too Much Business / Need to Expand — $9,500 at 20% — AA Credit — DTI 45% A new loan funded (Too Much Business / Need to Expand — $9,500 at 20%).  I participated via a 2 standing orders (Low Amt Extreme DTI and Low Amt Any DTI) and a manual bid the loan was Autofunding.  The borrower had AA credit and 45% DTI.  As a reminder my standing orders......
  • Prosper IRR Lender “Game” Mar 07 Update It is time for the March 2007 update of the IRR Lender “Game.”  This is going to be more about accomplishments during the last month rather than pure calculations.  So without further ado: Highest IRR Model: epetroel 8.07%  Largest IRR Model Improvement: LazyMan by going from 1.06% to 5.62% he improved 4.56%.  Lowest IRR Model: Leporello......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

One Response to “Another Massive ID theft ring”

  1. Avery J. Parker - Web site hosting and computer service Says:


    [...] The other day I did a post about Sunbelt mentioning another big identity theft ring. That post that I referred to has been pulled from their site. [...]


Switch to our mobile site