Robbing a bank? Carberp toolkit now available for just $5k: Cybercrooks are selling the source code for the Carberp banking Trojan toolkit through underground forums – at just $5,000 a pop.
The sale of the building blocks for the banking Trojan toolkit is a sign of “conflict within the team”, according to Andrey Komarov of Russian security firm Group-IB.
“Some of the members would love to destroy the project and move onto another business or new product,” Komarov told El Reg.
The toolkit for sale consists of the full source code of Carberp, including: comments; web-injects; all the Carberp modules; source code of Gazavar (the worm module); the admin panel for the command and control servers; Windows exploits related to vulnerabilities patched last year (specifically CVE-2012-1864 and CVE-2012-0217); a bootkit module, and many other components. The complete archive weighs in at 5GB.
Forum user “madeinrm” states that he is offering the source code for sale because someone else using the nickname “batman” had already passed on the source code to a third party, apparently against madeinrm’s approval.
Madeinrm said he intends to screen potential customers but is nonetheless looking to sell the hitherto secret code powering the malware to a large number of people, rather than selling it at a higher price through an exclusive deal.