Vawtrak

Vawtrak, also known as Neverquest and referred to in one source as “Gozi 2 Prinimalka,” is an e-banking Trojan/banking Trojan associated with credential theft and online banking fraud. The content explicitly describes banking trojans such as Vawtrak as using man-in-the-browser techniques to steal credentials from targeted victims. It is also referenced as part of the broader Gozi lineage, with one source stating that the Kuzmin Gang evolved Gozi v1 into Gozi v2, which later became “Gozi 2 Prinimalka,” also called Vawtrak.

The malware appears in multiple delivery and hosting contexts in the provided content. Hancitor was observed in its early years delivering Vawtrak. H1N1 is described as a loader variant known to deliver Vawtrak executables to infected machines. Bedep build 1926 was observed delivering Vawtrak campaigns 13 and 60 in November 2015 during Angler exploit kit-related malvertising activity. The content also states that Vawtrak payloads were likely delivered in exploit-kit activity involving Neutrino, and that URLZone had been observed loading Vawtrak and other banking trojans. Avalanche infrastructure hosted Vawtrak/Neverquest as part of a large criminal fast-flux ecosystem used for phishing, malware distribution, and botnet communications.

The provided content ties Vawtrak to financially motivated cybercrime ecosystems rather than a single exclusive operator. It is associated with banking-trojan activity, exploit-kit delivery, spam/downloader delivery chains, and criminal hosting infrastructure. Mentioned infrastructure and indicators include Vawtrak command-and-control servers ninthclub[.]com (81.177.22.179) and atlasbeta[.]com (176.9.188.147), identified in the Bedep/Angler-related reporting. The content also notes that Avalanche-linked malware, including Vawtrak, targeted Microsoft Windows systems and activity affecting major financial institutions.