Crisis: Virus infects even virtual machines

xxcrackerxx

New Member
Thread author
Jun 30, 2012
137
Da Vinci: Italian Hacking tool for government authorities.
Two rather rare specific features have struck with the recently Trojan appeared for the first time "Crisis" the virus researchers of Symantec: Before the pest neither virtual machines nor mobile phones are sure.

If a system is infected for the moment with "Crisi", the Trojan not only by means of Keylogger can intercept all keyboard inputs, but also activate the Webcam and be of use as well as monitor Skype telephone calls. A Backdoor for reloading of other program modules belongs of course also to the functional extent. In principle, "Crisis" offers full-extensive spy possibilities for all infected calculators to his operator therefore.

However, incredibly the Trojan becomes only by his possibility to infect VMWare images. Thus he can be further on his duty even if the user begins a virtual machine. Besides, "Crisis" infects all, recordable data carriers used in the PC automatically by first-time use. Mobile phones with Windows mobile also belong to it as an operating system. The more modern variation Windows Phone as well as iOS and Android, however, are sure before him.

On grounds of his mighty features and because "Crisis" up to now yet in the wild was not sighted, experts assume from the fact that the Trojan was programmed for some, special areas of application as for example state spying. Supposedly the Trojan is a part of the spy suite "da Vinci" which has developed an Italian company especially for the application by government authorities.

davinci-52acdece77f29eb6.jpg
 

HeffeD

Level 1
Feb 28, 2011
1,690
Here is an article from Ars Technica. VMware virtual machines targeted by “Crisis” espionage malware

An important thing to note with this malware is that it isn't designed to jump out of a VM and infect the host. Rather, once the host is infected, it will search for .vmdk disk images to infect, thus infecting the VM. An important distinction if you ask me. It would be more worrisome if it could infect the host from the VM, not the other way around.
 

Littlebits

Retired Staff
May 3, 2011
3,893
Ok thanks HeffeD, also Symantec has info here- http://www.symantec.com/security_response/writeup.jsp?docid=2012-081606-2200-99


Threat Assessment
Wild
Wild Level: Medium
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy
Damage
Damage Level: Medium
Payload: Opens a back door.
Releases Confidential Info: Logs keystrokes, steals clipboard data, records webcam, monitors Internet traffic, takes screenshots.
Compromises Security Settings: Terminates antivirus processes.
Distribution
Distribution Level: Medium
Target of Infection: Removable drives, VMware images, and possibly Windows Mobile devices.

It really doesn't look like a serious risk.

Thanks.:D
 

Gnosis

Level 5
Apr 26, 2011
2,779
I don't guess that a viral VM infection should surprise me, at least when considering that viruses are so noisy and reckless. That said, I am curious about the host program that viruses need to "infect" in this potential case, unlike worms that go it alone. Nonetheless, this is fascinating stuff!
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top