For those interested in the guts of malware and who have a bit of expertise reading Perl code (it's much like PHP, really), Websense's Alex Rice has done a walkthrough of the source code - which he's somehow acquired - to a script called Web Attacker.
It's used - a lot - to try to install Trojans onto anyone visiting malicious sites. You've probably, without knowing it, visited a site that used it.
While reading our previous posts, you may have noticed quite a few references to something called the Web-Attacker toolkit. The reason we have mentioned Web-Attacker so frequently is that nearly one-third of the malicious websites we discover are using it to infect their victims; it is incredibly popular.
And there follows an examination of the program, which (in the most prosaic code; it's not, as Rice points out, elegantly or even in some places correctly written, and nicks some modules from public sources - goodness me) notes who's been visiting, where from, when, with what browser, and whether the site succeeded in dropping your nasty bit of malware on them.
After which, presumably, you can watch them log into their online bank, or eBay, or their IM service, all the while using their machine to store illicit files and send spam.
Rice concludes:
The code certainly is not what you would call "elegant," and it honestly is not incredibly advanced. However, it is amazingly easy to use, has plenty of features, is frequently updated, and just gets the job done. Apparently those four things are the recipe for a wildly successful exploit toolkit.
