Clampi (also known as Ligats, Ilomo, or Rscan) [1] is a strain of computer malware which infects Windows computers. More specifically, as a man-in-the-browser banking trojan designed to transmit financial and personal information from a compromised computer to a third party for potential financial gain as well as report on computer configuration, communicate with a central server, and act as downloader for other malware. [2] Clampi was first observed in 2007 affecting computers running the Microsoft Windows operating system. [3]
Clampi monitored over 4000 website URLs, effectively keylogging credentials and user information for not only bank and credit card websites, but also reported on utilities, market research firms, online casinos, and career websites. [4] At its peak in the fall of 2009, a computer security professional stated that it was one of the largest and most professional thieving operations on the Internet, likely run by a Russian or eastern European syndicate. [5] False-positive reporting of Clampi is also often used by tech support scammers to pressure individuals into sending them money for the removal of fake computer viruses. [6] [7]
Computer security analyst Nicolas Falliere claimed that "few threats have had us scratching our heads like Trojan.Clampi." It was the first trojan found to be using a virtual machine called VMProtect to hide its instruction set. [8] He remarked that the use of a virtual machine added weeks to the time required for programmers to disassemble and describe the threat and mechanism of action. [2] He discovered it logged and transmitted personal financial information from a compromised computer to a third party for potential financial gain as well as reported on computer configuration, communicated with a central server, exploited Internet Explorer 8, set up a SOCKS proxy, and acted as downloader for other malware. The virus was sophisticated enough to hide behind firewalls and go undetected for long periods of time. [9] A list of around 4,800 URLs were CRC encoded (similar to hashing). This was dictionary attacked against a list of common URLs in September 2009 to produce a partial list of known sites with some duplication and ambiguity. [2] The source code has never been reported to be shared or sold online.
A list of components discovered through decryption of the executable in 2009: [2]
{{
cite journal}}
: Cite journal requires |journal=
(
help)