Signature Detail

WORM: Berbew Keylogger Upload

This signature detects the Berbew worm as it uploads keylogger information to a listening post. Berbew monitors user keystrokes for financial data and then reports that information to an attacker, via HTTP, to a listening post. Source IP addresses that trigger this signature are extremely likely to be infected with the Berbew worm.

Extended Description

Berbew is a Trojan horse that monitors keystrokes, steals sensitive information, and reports to a remote attacker. It also opens a backdoor and accepts control commands from a remote attacker.

References

• URL: http://secunia.com/virus_information/19349
• URL: http://www.cit.cornell.edu/computer/security/alerts/berbew.html
• URL: http://securityresponse.symantec.com/avcenter/venc/data/backdoor.berbew.g.html