Vawtrak Trojan Hides Updated Server List in Website Icons

The Vawtrak (aka Snifula) multifunctional malware has been around since mid-2013. Its information-stealing, backdoor and spying capabilities deservedly earned it the description as the "Swiss army knife" of malware.

Since its creation, the authors have been constantly tweaking it, changing features, target regions or banks. Spread via exploit kits, malware downloaders and through drive-by downloads, chances are good that at one time or other many users have run into it.

This February, for example, researchers have repeatedly spotted it being delivered via malicious macros.

AVG developer Jakub Kroustek has recently penned a whitepaper analyzing the threat and the latest improvements it received. Among these is an improved way of receiving updated lists of live C&C:

"[The malware's] update servers are hosted on the Tor hidden Web services and they are accessed via a Tor2web20 proxy without a need to install any special software such as Torbrowser. Moreover, the communication with the remote server is done over SSL, which adds further encryption," he explained.
 
Full Article