Win32/Aibatook: Banking Trojan Spreading Through Japanese Adult Websites

This blog post will explore a malware family named Win32/Aibatook, which targets Japanese users’ banking information and hosting providers’ account credentials. It appeared at the end of 2013 and a previous version has already been documented by Symantec, which has even sinkholed some of Win32/Aibatook’s C&C servers. Far from being discouraged, the operators have since published an updated version and moved from Delphi to C++ as their programming language. This post will focus on this new strain, which came out in April 2014 and has some interesting quirks:



Win32/Aibatook: Banking Trojan Spreading Through Japanese Adult Websites