According to a post on the Russian cybercrime forum, i2Ninja offers a similar set of capabilities to the ones offered by other major financial malware: HTML injection and form grabbing for all major browsers (Internet Explorer, Firefox and Chrome), FTP grabber and a soon to be released VNC (Virtual Network Connection) module. In addition, the malware also provides a PokerGrabber module targeting major online poker sites and an email grabber.
The i2Ninja takes its name from the malware’s use of I2P – a networking layer that uses cryptography to allow secure communication between its peer-to-peer users. While this concept is somewhat similar to TOR and TOR services, I2P was designed to maintain a true Darknet, an Internet within the Internet where secure and anonymous messaging and use of services can be maintained. The I2P network also offers HTTP proxies to allow anonymous Internet browsing.
Using the I2P network, i2Ninja can maintain secure communications between the infected devices and command and control server. Everything from delivering configuration updates to receiving stolen data and sending commands is done via the encrypted I2P channels. The i2Ninja malware also offers buyers a proxy for anonymous Internet browsing, promising complete online anonymity.
Another feature of I2P by i2Ninja is an integrated help desk via a ticketing system within the malware’s command and control. A potential buyer can communicate with the authors / support team, open tickets and get answers – all while enjoying the security and anonymity provided by I2P’s encrypted messaging nature. While some malware offerings have offered an interface with a support team in the past (Citadel and Neosploit to name two), i2Ninja’s 24/7 secure help desk channel is a first.
Below is a translation from Russian of the original post introducing the capabilities of i2Ninja:
We would like to introduce a unique product to you, a bot by the name of i2Ninja, and tell about its various advantages. First and foremost, is its use of the I2P network for botnet control, commands, updates, injection upgrade, removing and adding different modules.
Product functionality:
1. 24/7 I2PTicket system for supporting customers (communication with our support is done straight from the admin panel. All messages, are naturally – encrypted).
2. Module kit:
– Formgrabber (IE/FF/Chrome all versions)
– HTTP/HTTPS injections (Stable in all IE/FF/Chrome browsers)
– I2P Proxy (Access the web through I2P and it’s impossible to trace you. No other proxy server will give you such a level of security. No matter how secure proxy-server operators will position themselves to be, your IP is still logged somewhere in the process!)
– FTPgrabber (33 clients)
– PokerGrabber (The most popular clients – 88poker, Absolute Poker, Cake Poker, Full Tilt Poker, Party Poker, PokerStars, Titan Poker)
– MailGrabber (16 services)
– Schedule DLL or EXE loading tasks. This is scheduled through the control panel (LoadLibrary, regsvr32, run from memory without the need to encrypt).
– FILESEARCH – another built in module which allows to search/remove files or according to preferences send them to admin panel (it’s possible to task collection/removal of all files with a certain extension or an exact file name).
3. Coming Soon
-VNC (hidden session)
This post was actually copied from a different source and shared within this forum on a thread discussing P2P Trojans. The cybercriminal who originally made the offer commented on this thread and confirmed that indeed this malware is for sale at this time. As the thread progressed that same cybercriminal requested that the thread is shutdown as he received many requests for purchasing the i2Ninja malware. With increasing black market activity and the release of various malware source code, we expect to see a new malware variants and new underground offering in 2014. Trusteer’s security team will continue to monitor the underground for any additional details.
Etay Maor | Fraud Prevention Manager | Trusteer
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.