Stegoloader

Stegoloader (or Win32/Gatak) is a spyware program that uses image files to hide some of its components from being identifiable as threats. Illicit software downloads are Stegoloader's only confirmed infection vector, and malware experts have seen Stegoloader infections also including other malware, such as password collectors and components of the Pony botnet. Due to its multiple component structure, deleting Stegoloader should use anti-malware products that are capable of scanning your system as thoroughly as possible for eliminating all likely security issues.

A Picture Worth a Thousand Infections

Stegoloader is one of many high-level threats verified for using steganography or the art of concealing information (such as a program's code) in an image file. Other threats seen using similar techniques without any direct relationship to Stegoloader include the Zberp Trojan, the backdoor Trojan MiniDuke trojan, Shady Rat, and the Alureon rootkit. Like them, Stegoloader is a high-level threat including advanced methods for collecting information and concealing itself, with a handful of other features for compromising the PC's general security.

Stegoloader has yet to be seen being installed in targeted campaigns against specific organizations but is being distributed randomly in compromised, pirated software downloads. Victims who launch the downloaded file also launch a loader component that downloads Stegoloader's central component, which disguises itself as a PNG image file. This image file contains the code needed to install Stegoloader's main body, which could, in turn, use software exploits for installing other malware.

Besides its potential for downloading other threats, malware analysts have highlighted the following, distinctive Stegoloader features:

• Stegoloader may include additional features for evading security analysis besides its steganography, such as the RC4 data encryption, self-termination for machines with no mouse activity, detecting specialized security tools and using dynamic string construction.
• Stegoloader may harvest basic system information, including which programs have been installed, your Web browser's history and any recently-opened documents. Firefox, Internet Explorer and Chrome are specific targets.
• The Stegoloader spyware also operates as a limited trojan downloader by installing a Pony botnet-based password stealer that could grant criminals access to your personal login data.
• In the event of its administrators rating an infected machine as a viable target, Stegoloader may accept optional attack commands from a remote server.

Stopping a Picture from Loading All Your Accounts

Stegoloader may be installed with members of the Virtumonde family of Trojans, which is infamous for its abuse of pop-up warnings. However, by itself, Stegoloader shows no symptoms of any notable visibility. Its memory-resident format also may make it difficult for PC users to identify obvious files or processes associated with Stegoloader's components. Updated anti-malware products continue to be the best after-the-fact means of deleting Stegoloader and similarly high-level threats.

On the other hand, stopping common threat distribution channels also can provide an equally important form of protection for any PC. Since Stegoloader requires its victims to install an illicit program prior to gaining access, its sophisticated defenses are easily stopped by anyone willing to check their downloading habits. To date, malware researchers have seen no signs of Stegoloader's campaign using non-consensual browser exploits, e-mail attachments or other methods that could harm even law-abiding PC owners.