MSRT November 2013 - NapolarWe first noticed the new family we named
Win32/Napolar being distributed in the wild in early August this year. It quickly became a big problem on our customers’ machines.
Napolar is one of two families targeted by the Malicious Software Removal Tool (MSRT) this month. The other is the bitcoin mining family Win32/Deminnix.
As shown in the chart below, Napolar was hitting ~220K unique machines during the week of August 23rd.
Napolar is a trojan that can download and run files, utilize your machine’s resources to conduct a DDoS attack or serve as a SOCKS proxy, monitor network traffic, and steal credentials for FTP, POP3 and websites. There is also a plugin infrastructure designed in Napolar, but we haven’t seen much usage of it.
http://blogs.technet.com/b/mmpc/archive/2013/11/12/msrt-november-2013-napolar.aspx
