Menu
New information-theft malware 'Napolar' is gaining traction, researchers warn

New information-theft malware 'Napolar' is gaining traction, researchers warn

Active development, cheap price and solid features might drive more cybercriminals to it in the future

A new piece of information-stealing malware that appeared earlier this year has been rapidly gaining traction during the past few weeks, with hundreds of infection attempts being detected every day by antivirus vendors.

The malware is called Solarbot and its creator first started to advertise it to cybercriminals in May, security researchers from antivirus vendor Avast said Wednesday. The number of infection attempts using this malware increased significantly over the past few weeks, the researchers said.

Researchers from antivirus vendor ESET have also been tracking the same threat. "We have uncovered many details about this bot since it became active at the end of July, with in-the-wild infections starting mid-August," they said. "There have been reports of thousands of infections, many of them in South America."

Both Avast and ESET antivirus products detect the malware under the name Napolar.

Solarbot/Napolar is advertised through a professional-looking and publicly accessible website that lists the malware's features and tracks the development progress in an actively updated changelog. The site also provides a manual for using the malware and information on how to develop plug-ins for it.

According to the ESET researchers, buying the malware's binary file, which can be used to infect computers, costs US$200.

Solarbot is able to launch several types of DDoS (distributed denial-of-service) attacks, can act as a reverse SOCKS5 proxy, steal POP3 and FTP login credentials from many email and FTP clients, and steal information entered by victims into Web forms in Internet Explorer, Mozilla Firefox or Google Chrome.

However, the malware's functionality can be extended through plug-ins. The bot's developers offer a plug-in SDK (software development kit) and also provide some example plug-ins to steal Bitcoin wallets or collect computer information.

According to data received by Avast from installations of its products, infection attempts with Solarbot are detected on several hundred unique computers every day. The malware's distribution seems to be global, but the most-affected countries are Colombia, Venezuela, Peru, Mexico, Argentina, Philippines, Vietnam and Poland.

Researchers from ESET suspect that the malware is spread through compromised Facebook accounts, because some of the samples found so far have names like "Photo_032.JPG_www.facebook.com.exe." The malware can steal Facebook log-in credentials using its form-grabbing feature, so attackers can use those credentials to access Facebook accounts and spread the malware to other people, the researchers said.

Although this bot is similar in functionality to Trojan programs like Zeus or SpyEye that are already widely used, its popularity might grow because it is actively maintained, easy to use and can be extended easily through plug-ins, the ESET researchers said.

Due to its solid malicious performance and reasonable price of $200, this bot could be on the rise in the near future, the Avast researchers warned.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securityAvasteset

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments