The Trojan installs a keylogger capable to capture keystrokes including username, password and credit card number.
Bitrix, Inc., a technology trendsetter in business communications solutions, alerts customers about the existence of a Trojan program pretending to be the Bitrix security framework. The Trojan is capable of stealing confidential data from infected computers and received the highest threat level from malware experts.
Identified as a part of the “Agent” malware family, the Trojan is presumably spread using mass mailing of spam and malicious links. The malware can be delivered to the target computer in different flavors including pretending to be a Microsoft Silverlight or Bitrix security update. If a user launches the infected file, the Trojan installs itself into the system by creating multiple files and registering itself in the system registry. After installation the malware unobtrusively runs in the background, captures keystrokes and sends out collected data to an external service. This way a malicious person can obtain the user’s confidential information including username, password and credit card number.
The Trojan can be identified by the presence of “Bitrix Security” folder in the application data directory which contains a number of supplementary files and a run-time library under randomly generated names (for example xaukvmm60.dll).
Bitrix recommends that users update their virus scanners and check their computers against this malicious program.
Read more about how to protect your web assets against web-borne malware in a dedicated white paper "10 Ways to Keep Hackers in Check and Ensure Safe Web Resources" by Marcel Nizam, Head of Web Security Development at Bitrix, Inc.