http://blogs.technet.com/b/mmpc/archive/2015/08/11/msrt-august-2015-vawtrak.aspx
TL;DR
TL;DR
- Vawtrak aka NeverQuest and Snifula
- Banking trojan
- Angler, attachments - with Chanitor downloader
- The Vawtrak dropper installs a DLL component to %ALLUSERPROFILE%\<random folder name>\<random file name>.
- The random folder and file names are generated using a linear congruential generator (LCG) algorithm and the volume serial number of system drive as the seed.
- It is fixed for a specific PC whenever the malware runs.
- The malware also uses the same trick to store configuration information to the registry, to make it easier for the threat to retrieve the configuration after reboot or update.
- It then injects the DLL into all running processes and browsers.
- Once Vawtrak is running in a web browser process it steal your user names and passwords for some websites. The website targeted can vary. The malware also contacts its command and control server to get configuration files and other bot commands.
