Trend Micro threat information advisory: Bredolab poses increasing pain point

The said attachment is actually a backdoor detected as BKDR_Bredolab.AL, which also downloads a RENOS Trojan (RENOS Trojans are known file downloaders, usually Rogue Antivirus).

Bredolab malware is gaining ground right now. According to Trend Micro research the criminals behind the common activities attributed to Zeus campaigns have apparently included another module in their deployments.

According to Ivan Macalintal, research program manager

"We expect to see much more of this threat down the road as a pain point for Internet users round the world"

This module has been named Bredolab, and in the past week, Trend Micro threat researchers submitted multiple new variants of this malware which were seen in major criminal campaigns such as the UPS and DHL spam campaigns.

The methods by which it infiltrates PC's are using the latest exploits (such as PDF, SWF) on malicious web sites and secondly, spammed attachments. Its primary function is to act as a Downloader of sorts and is being seen mainly to have been associated with fakeAV, rootkits, spambots (such as Cutwail), and other info-stealers

Once triggered, Bredolab malware then communicates with a backend management kit that automates what is downloaded, installed and executed to infected PC's.

Fortunately, new technologies are becoming available to counter these ever growing threats. On a daily basis, Trend Micro Smart Protection Network protects customers from over 1bn threats.