Beware of the Dyre banking Trojan! – A new malware threat that steals financial information such as login credentials. News of rhe Dyre banking Trojan has been circulating the web recently, following its discovery.
Dyre or Dyreza as it is also known exhibits classic banking Trojan behaviors such as using “man-in-the-middle” attacks to steal private information from victims. It is also being used on customers of certain banks in targeted attacks.
PhishMe identified this new malware on June 11, 2014. The Trojan is distributed via spam email messages that used similar email templates to other banking Trojan and malware distribution campaigns. Rather than infection occurring via a malicious attachment, the messages contained a link to a file hosted on Cubby.com: A free cloud storage provider. This campaign follows a recent trend in which cloud-hosting providers such as Cubby.com and Dropbox are used to host the malicious payloads.
As others within the blogosphere have noted, the Dyre banking Trojan is unique and represents a new type of malware being used by cybercriminals to steal banking credentials. Despite this novelty, its basic functionalities follow those that have long been employed by malware authors to exfiltrate private information from compromised systems. It’s a case of “the more things change, the more they stay the same.”
The Dyre banking Trojan works by ensuring that its hostile code is linked to the code of the victim’s web browser. As victim’s browse the Web, their web browser is effectively turned against them. This is part of the classic “man-in-the-middle” attack used by many malware types, including the prolific and notorious Zeus banking Trojan. As seen below, the binary data from this hostile code references browsers by name.
Part of the functionality is provided by “hooking” this malicious code into the browser’s runtime. Malicious actions then occur when the victim visits specific URLs or domains. This method has been seen before. Zeus Trojan variants and other banking Trojans such as Cridex use similar tactics. This can be seen in the malicious code itself as a list of URLs for popular banking websites, including the following:
- businessaccess .citibank .citigroup .com/assets/
- cashproonline .bankofamerica .com/assets/
- www .bankline .natwest .com/
- www .bankline .rbs .com/
- www .bankline .ulsterbank .ie/
The “hooking” and the focus on a set of banks are examples of ways in which this new banking Trojan reuses methods common to many other types of malware. These methods are expected of many modern banking Trojans and are not out of the ordinary.
How is this threat actor likely to attack your organization? The source code of the malware provides a clue—in fact, it is the source of the name “Dyre”.
The hostile code “hooked” to browser processes by the malware contains a reference to the location of a “.pdb” or program database file. Compilers store data for debugging using this file type. More important to those seeking threat intelligence, it provides some information about how the malware writer or writers created this malicious software.
In the fight against malware distributors, knowledge is a powerful weapon. Leveraging actionable threat intelligence gives you the opportunity to identify the source of the infection. Armed with that information it is easier to mitigate the threat. PhishMe analyses these and other threats and uses the information to deliver active threat reports to help organizations take fast action to prevent malware attacks.
Machine-readable threat intelligence (MRTI) is provided in multiple formats to ensure that organizations are better prepared for malware and phishing attacks, thus preventing them from disrupting business processes and causing financial harm. Of course, not all organizations require threat intelligence to be fed through other systems. We also provide human-readable reports on the latest threats, allowing deeper analysis of the latest, and most serious threats. After all, being forewarned is being forearmed.