Waledac malware returns after two years with password-stealing capabilities

A new version of the Waledac malware. capable of stealing passwords and BitCoins, has been detected in the wild

A new version of the Waledac malware has been spotted on the Internet, but unlike previous variants, which were mainly used for spamming purposes, this one steals various log-in credentials and BitCoins, a type of virtual currency.

"The sample was originally detected on Feb 2nd and the first coverage by a major AV was not observed until Feb 13th," researchers from network security firm Palo Alto Networks announced in a blog post on Tuesday.

The original Waledac botnet was one of the top spam sources on the Internet until it got shut down by Microsoft in cooperation with other security vendors in March 2010.

However, the new version's primary goal might no longer be spam, said Wade Williamson, a senior product manager at Palo Alto Networks. That's because it also steals FTP, POP3 and SMTP user passwords, as well as .dat files for BitCoin wallets.

This is the first time that Palo Alto Networks' firewall products have spotted Waledac-related activity since the original botnet was shut down two years ago, Williamson said.

The botnet's two-year inactivity was confirmed by antivirus firm BitDefender. "We have closely monitored the Web space during international events such as the deaths of political leaders and calamities – moments when the Waledac botnet would run at peak capacity before the takedown and did not notice any malicious activity on that front," said BitDefender E-Threats Analyst Bogdan Botezatu.

It's difficult to determine with certainty if the new version is the creation of the original Waledac authors, but its high similarity to the old variant suggests that it is the work of someone with access to the original source code, Williamson said.

"What it is sure is the fact that the newly added functionalities (email and FTP credentials harvesting) will contribute to an explosive development of the new botnet," Botezatu said. "FTP accounts will likely be used to accommodate binary copies of the bots, while the e-mail accounts will be used to propagate spam through not-yet-blacklisted mail servers."

Palo Alto Networks researchers have determined that the new Waledac version is being distributed through Web sessions, probably with the help of exploits hosted on compromised websites. According to Botezatu, BitDefender is also investigating this possibility.

"We recommend users to deploy and update a security solution with antispam and antivirus modules," Botezatu said. "We also advise that users rely on SFTP and SSL when connecting to FTP and mail servers, respectively, in order to minimize the risk of network sniffing."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?