Re: Iframe-Cash/Iframe-Dollars Adware bundle...oooh... my ....god..

[Reversemode <advisories@xxxxxxxxxxxxxxx>]

Hi,

The BHO you are talking about is part of a banking malware toolkit which
is  being sold probably.

Among other things (password stealer), this BHO has backdoor and
"botnet" capabilities, implementing several remote commands:
+ upload
+ run
+ update
...

This toolkit also comprises various "infection management system" php
scripts :
+ statistics  about infections, countries...
+ users/victims tracking
+ logs parsing
...
The BHO communicates directly with those scripts for sending and/or
receiving captured information and remote commands respectively.

Watch out for unexpected http traffic containing
commandack.php,mailwab.php..

Cheers,
-Rubén.