Chanitor

Chanitor is a Trojan downloader whose campaigns frequently use fraudulent e-mail messages for distribution, and enable the installation of other threats, such as banking Trojans. As of its latest campaign, malware experts have verified a degree of personalization in Chanitor attacks, which may include reference information and use disguises associated with Microsoft or other, equally legitimate companies. Windows users, especially those on corporate networks, should be cautious of potential messages that redirect to attack sites, and delete Chanitor with anti-malware tools, as per the usual protocols.

When Microsoft Services Turn into Trojans

Trojan downloaders may be the intermediaries in threat campaigns; being served by initial attacks, and then serving other threats, in turn, to the compromised PC. Chanitor keeps to this traditional role of a threat while using disguises meant to fool business employees interested in Microsoft's VLSC products. Typical Chanitor attacks begin with specially-crafted e-mails purporting to be from Microsoft, including custom-made links for the targeted victim. The internal message text also includes personal references, such as employee names and e-mail addresses.

Clicking the supposed 'Microsoft.com' URL redirects the victim to a fake page for the Volume Licensing Service Center. Malware experts can confirm at least four variants of this WordPress-based domain. Although the people responsible designed this page to look identical to that of its real Microsoft counterpart, the download URL for Chanitor's installer (a ZIP file) uses an inappropriate host server.

Other disguises seen in use by Chanitor include fake invoices, fax messages and package delivery notifications. All of these tactics are common to e-mail attacks and, in many cases, attacks against specific corporate employees.

With its installation finished, Chanitor then automatically downloads and installs other threatening software of a variable nature. Malware experts can particularly point to the likelihood of Chanitor's distributing spyware, backdoor Trojans and similar threats meant to enact large security vulnerabilities or collect data. However, Chanitor doesn't distribute itself to other networks, devices or machines automatically, unlike the worms that are common to some corporate espionage attacks.

How Chanitor Breaks the Sandbox

In most respects, Chanitor is a traditional Trojan performing a traditional role in its threat campaigns. However, malware experts also took note of Chanitor's using exceptional steps to prevent itself from being analyzed by various security companies. Chanitor automatically detects sandbox environments and terminates itself in a matter of seconds, without delivering its payload. A Sleep Mode feature also could allow Chanitor to disable itself temporarily, before potentially resuming its activities after the removal of any interfering security processes. Even its network traffic uses TOR (formerly 'the Onion Router'), an anonymity service.

Chanitor also includes several methods of preventing PC users from identifying Chanitor as a threat and deleting it, including using different file names and copying its components. Although anti-malware products and features remain your best defense against Chanitor, a majority of PC security companies haven't developed threat entries for this Trojan. Removing Chanitor may require updates to your anti-malware tools or additional steps for removing the other threat installed.