The cyber crime underground provides a robust marketplace for buying and selling different malware variants. Some of the major malware families, such as Zeus, Citadel, Ramnit, Spyeye and others, are well known financial malware. Lurking in the dark shadows of the Internet, some cyber criminal groups prefer to keep a low profile and not sell their tool of choice to the general underground public; Torpig, aka Sinowal, is one example of such a case. Trusteer’s security team has identified a new offering in a Russian cyber crime forum, a malware variant that, until now, has been working incognito: the i2Ninja malware.

i2Ninja Malware Unmasked

According to a post on the Russian cyber crime forum, i2Ninja offers a similar set of capabilities to those offered by other major financial malware: HTML injection and form-grabbing for all major browsers (Internet Explorer, Firefox and Chrome), a FTP grabber and a soon-to-be-released Virtual Network Connection (VNC) module. In addition, the malware also provides a PokerGrabber module, which targets major online poker sites, and an email grabber.

The i2Ninja takes its name from the malware’s use of I2P, a networking layer that uses cryptography to allow secure communication between its peer-to-peer users. While this concept is somewhat similar to TOR and TOR services, I2P was designed to maintain a true Darknet, an Internet within the Internet where secure and anonymous messaging and use of services can be maintained. The I2P network also offers HTTP proxies to allow anonymous Internet browsing.

Using the I2P network, i2Ninja can maintain secure communications between the infected devices and command and control server. Everything from delivering configuration updates to receiving stolen data and sending commands is done via the encrypted I2P channels. The i2Ninja malware also offers buyers a proxy for anonymous Internet browsing, promising complete online anonymity.

View on-demand webinar: Cybercriminals Never Sleep

Another feature of I2P used by i2Ninja is an integrated help desk via a ticketing system within the malware’s command and control. A potential buyer can communicate with the authors/support team, open tickets and get answers, all while enjoying the security and anonymity provided by I2P’s encrypted messaging. While some malware offerings have featured an interface with a support team in the past (Citadel and Neosploit, to name two), i2Ninja’s 24/7 secure help desk channel is a first.

Below is a translation from Russian of the original post introducing the capabilities of i2Ninja:

We would like to introduce a unique product to you, a bot by the name of i2Ninja, and tell about its various advantages. First and foremost is its use of the I2P network for botnet control, commands, updates, injection upgrade, removing and adding different modules. 1. Product Functionality: 24/7 I2PTicket system for supporting customers (communication with our support is done straight from the admin panel. All messages, are — naturally — encrypted) 2. Module Kit: Formgrabber (IE/FF/Chrome, all versions) HTTP/HTTPS injections (Stable in all IE/FF/Chrome browsers) I2P Proxy (Access the Web through I2P and it’s impossible to trace you. No other proxy server will give you such a level of security. No matter how secure proxy server operators will position themselves to be, your IP is still logged somewhere in the process!) FTPgrabber (33 clients) PokerGrabber (The most popular clients — 88poker, Absolute Poker, Cake Poker, Full Tilt Poker, Party Poker, PokerStars, Titan Poker) MailGrabber (16 services) Schedule DLL or EXE loading tasks. (This is scheduled through the control panel. LoadLibrary, regsvr32, run from memory without the need to encrypt.) FILESEARCH (Another built-in module that allows searching/removing files or, according to preferences, sending them to admin panel. It’s possible to task collection/removal of all files with a certain extension or an exact file name.) 3. Coming Soon: VNC (hidden session)

Malware for Sale

This post was actually copied from a different source and shared within this forum on a thread discussing P2P Trojans. The cyber criminal who originally made the offer commented on this thread and confirmed that this malware is indeed for sale at this time. As the thread progressed, that same cyber criminal requested that the thread be shut down since he received many requests to purchase the i2Ninja malware.

With increasing black market activity and the release of various malware source codes, we expect to see new malware variants and new underground offerings in 2014. i2Ninja has already been discussed in several Russian-language cyber crime forums, and IBM Security’s security team (formerly Trusteer) is actively monitoring for a live variant of this malware. Once such an attack is identified and researched, we will update with new technical details.