The BokBot Trojan is a dangerous weapon used against computer users worldwide. It infects via vulnerabilities and other common methods. Our article gives an overview of its behavior according to the collected samples and available reports, also it may be helpful in attempting to remove the virus.
|Short Description||The BokBot Trojan is a computer virus that is designed to silently infiltrate computer systems.|
|Symptoms||The victims may not experience any apparent symptoms of infection.|
|Distribution Method||Software Vulnerabilities, Freeware Installations, Bundled Packages, Scripts and others.|
|Detection Tool|| See If Your System Has Been Affected by BokBot Trojan |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss BokBot Trojan.|
BokBot Trojan – Distribution Methods
The BokBot Trojan is a malicious banking Trojan which has recently been the subject of an in-depth code review. The security investigation follows several large-scale attacks that have made it a threat to be feared. The first campaigns carrying it were reported in April 2017 targeting financial institutions worldwide.
The main infection method is through web traffic manipulation. The BokBot Trojan will use a malicious proxy server which can hook up to vulnerable web servers and from there deliver the crafted pages. The visitors will see their online banks and when they interact with them all sent credentials will be recorded by the BokBot Trojan hackers.
There are two popular methods which can be used to deliver the threat:
- Vulnerability Exploitation — The hackers can target running web services and sites by attempting to find out weaknesses that are exploited using zero-day exploits and other methods. As soon as the web servers are penetrated the site’s contents can be modified in order to deliver the BokBot Trojan instances.
- Trojan Download — The other method relies on the victims themselves downloading and running the Trojan files. This can be done by either navigating to a malicious web pages, scam landing pages or interacting with phishing emails. Other popular methods rely on placing the virus installation instructions in files of various types — all popular document types (spreadsheets, presentations, text documents and databases) and software installers. As soon as they are opened the Trojan will be deployed to the target machines.
The infected files can be spread across different sources: web pages, emails, file-sharing networks and servers.
BokBot Trojan – Detailed Description
As soon as the BokBot Trojan has infiltrated a given machine it will run a proxy server that will relay all network traffic through a malicious server. This is also possible with secured content and streams due to a certificate that is presented to the system. The proxy server can detect which of the popular browsers are running due to the unique signatures that are placed in it. The collected samples feature ID checks for the following applications: Mozilla Firefox, Internet Explorer, Google Chrome and Microsoft Edge.
The Trojan will act against the browsers as soon as the affected web pages are visited by the users. It will launch scripts that can hook up to system services.
However banking Trojans like this one are mainly used to deliver manipulated web traffic. This is done by reconfiguring the infected web servers into serving hacker-devised content that is inserted into legitimate web pages. Target sites include the likes of e-commerce, sites, social network login pages and online banking.
Several advanced features are integrated into the Trojan’s modules list:
- URL Rewrite Bypass — As the hackers can deliver their own malicious pages instead of legitimate ones the Trojan needs to mask this operation. This is done by rewriting the URLs automatically which will make the browsers show the addres of a legitimate and safe service. At the same time hacker-made content is shown.
- Server Connection — The Trojan will automatically make a connection to a hacker-controlled server as soon as the infection is made. All made actions are logged in with details and instantly sent to the attackers. This allows them to spy on the users actions, take over control of the machines and deploy other threats if programmed to do so.
Such infections are very difficult to detect as they happen on the web servers affected by the virus. This means that the users may be entering in their account credentials and other information into dangerous sites without even knowing that they are giving in their information to hackers.
Threats like the BokBot Trojan are very difficult to detect without an advanced anti-spyware solution which can identify the signatures of the Trojan. Specialist servers, home computers and company networks.
Remove BokBot Trojan Completely
To remove BokBot Trojan manually from your computer, follow the step-by-step removal tutorial written down below. In case this manual removal does not get rid of the Trojan malware completely, you should search for and remove any leftover items with an advanced anti-malware tool. Such software can keep your computer secure in the future.