El BokBot troyano es un arma peligrosa utilizado en contra de los usuarios de computadoras en todo el mundo. Infecta a través de las vulnerabilidades y otros métodos comunes. Nuestro artículo da una visión general de su comportamiento en función de las muestras recogidas e informes disponibles, También puede ser útil en el intento de eliminar el virus.
Resumen de amenazas
|Nombre||BokBot de Troya|
|Descripción breve||The BokBot Trojan is a computer virus that is designed to silently infiltrate computer systems.|
|Los síntomas||Las víctimas no pueden experimentar síntomas aparentes de infección.|
|Método de distribución||Las vulnerabilidades de software, Instalaciones de dominio público, paquetes combinados, Guiones y otros.|
|Herramienta de detección|| See If Your System Has Been Affected by BokBot Trojan |
Herramienta de eliminación de software malintencionado
|Experiencia de usuario||Unirse a nuestro foro to Discuss BokBot Trojan.|
BokBot Trojan – Distribution Methods
The BokBot Trojan is a malicious banking Trojan which has recently been the subject of an in-depth code review. The security investigation follows several large-scale attacks that have made it a threat to be feared. The first campaigns carrying it were reported in April 2017 targeting financial institutions worldwide.
The main infection method is through web traffic manipulation. The BokBot Trojan will use a malicious proxy server which can hook up to vulnerable web servers and from there deliver the crafted pages. The visitors will see their online banks and when they interact with them all sent credentials will be recorded by the BokBot Trojan hackers.
There are two popular methods which can be used to deliver the threat:
- Vulnerability Exploitation — The hackers can target running web services and sites by attempting to find out weaknesses that are exploited using zero-day exploits and other methods. As soon as the web servers are penetrated the site’s contents can be modified in order to deliver the BokBot Trojan instances.
- Trojan Download — The other method relies on the victims themselves downloading and running the Trojan files. This can be done by either navigating to a malicious web pages, scam landing pages or interacting with phishing emails. Other popular methods rely on placing the virus installation instructions in files of various types — all popular document types (hojas de cálculo, presentaciones, documentos de texto y bases de datos) and software installers. As soon as they are opened the Trojan will be deployed to the target machines.
The infected files can be spread across different sources: páginas web, mensajes de correo electrónico, file-sharing networks and servers.
BokBot Trojan – Detailed Description
As soon as the BokBot Trojan has infiltrated a given machine it will run a proxy server that will relay all network traffic through a malicious server. This is also possible with secured content and streams due to a certificate that is presented to the system. The proxy server can detect which of the popular browsers are running due to the unique signatures that are placed in it. The collected samples feature ID checks for the following applications: Mozilla Firefox, Internet Explorer, Google Chrome y Microsoft Edge.
The Trojan will act against the browsers as soon as the affected web pages are visited by the users. It will launch scripts that can hook up to system services.
However banking Trojans like this one are mainly used to deliver manipulated web traffic. This is done by reconfiguring the infected web servers into serving hacker-devised content that is inserted into legitimate web pages. Target sites include the likes of e-commerce, sitios, social network login pages and online banking.
Several advanced features are integrated into the Trojan’s modules list:
- URL Rewrite Bypass — As the hackers can deliver their own malicious pages instead of legitimate ones the Trojan needs to mask this operation. This is done by rewriting the URLs automatically which will make the browsers show the addres of a legitimate and safe service. At the same time hacker-made content is shown.
- Conexión al servidor — The Trojan will automatically make a connection to a hacker-controlled server as soon as the infection is made. All made actions are logged in with details and instantly sent to the attackers. This allows them to spy on the users actions, take over control of the machines and deploy other threats if programmed to do so.
Such infections are very difficult to detect as they happen on the web servers affected by the virus. This means that the users may be entering in their account credentials and other information into dangerous sites without even knowing that they are giving in their information to hackers.
Threats like the BokBot Trojan are very difficult to detect without an advanced anti-spyware solution which can identify the signatures of the Trojan. Specialist servers, home computers and company networks.
Remove BokBot Trojan Completely
Para eliminar BokBot de Troya manualmente desde el ordenador, seguir el tutorial eliminación paso a paso escrita abajo. En caso de que la extracción manual no se deshace del malware de Troya por completo, usted debe buscar y eliminar los elementos sobrantes con una herramienta anti-malware avanzado. Este tipo de software puede mantener su equipo seguro en el futuro.