IBM X-Force researchers analyzed the activity of a relatively new banking Trojan known as BackSwap. BackSwap emerged in March 2018 and, until recently, had only targeted Polish banks. The malware’s target list now features six major banks in Spain.

According to X-Force analysis, BackSwap is its own malware project, but it is based on features that existed within the Tinba Trojan. The malware’s operators keep the code as their own project; in that sense, it is considered gang-owned and not commercial malware.

A Twist in the Tale

Overall, BackSwap is no more sophisticated than any other active banking Trojan. Its highlight is its webinjection mechanism. Instead of using the more common method of hooking browser functions, then creating different versions for each architecture, BackSwap injects JavaScript into the address bar.

By simulating user input to access the browser’s address bar and inserting the malicious script directly there, BackSwap can execute the script using JavaScript protocol URLs and bypass protections of both the browser and the bank’s third-party security controls.

In terms of what BackSwap does with the injections, this is where the novelty ends. Just as malware such as Zeus has been doing for over a decade, BackSwap uses malicious scripts to modify what victims see on their bank’s website in classic man-in-the-browser (MitB) style:

  • Scripts wait for a minimum amount of data to be transferred before replacing the destination account number.
  • Scripts inject mule account numbers on the fly via MitB.
  • Scripts hide the mule account number that the money will go to and instead present the original destination account the victim entered.

BackSwap’s Fraud Method

The likely fraud scenario based on BackSwap’s capabilities is in-session fraud automated by MitB malware scripts. The malware’s scripts wait for the user to go to a page where a transaction is to take place. When the victim initiates activity that’s interesting to the attacker, such as adding a payee or starting a money transfer, the malware replaces the destination account with a mule account number.

Figure 1: The BackSwap function responsible for account number replacement

Using MitB scripts to alter transaction details sent to the bank is not a new method. What’s new here is the way BackSwap implements it to circumvent third-party security on the bank’s website. This method can be more successful with banks that don’t require two-factor authentication (2FA) or out-of-band transaction authorization (OOBA) from customers moving money to other accounts.

Malware Spam and Then Some

BackSwap is most often delivered to users via malware spam, concealed in an attachment of a productivity file like Microsoft Word or bundled inside other programs. BackSwap favors popular freeware or open source programs and plants its code in the initialization phase of the program. When run during an early stage of the program’s execution, the code replaces the installation routine with malicious instructions that execute BackSwap instead. One interesting choice was Ollydbg.exe, which is a program often used by malware researchers.

Testing Attack Turfs

The malware’s attack scope has thus far been limited to a few banks in Poland and some banks in Spain, specifically targeting personal banking.

The limited number of banks in each country so far may suggest that BackSwap is still in testing. Our research team expects to see more testing in other geographies in the coming weeks, and possibly a wider scope of attack for this Trojan in the fourth quarter of 2018.

Will we see BackSwap on the top 10 list of financial malware in 2019? IBM X-Force will keep updating its information on BackSwap via the X-Force Exchange.

Figure 2: Top most prevalent financial malware families (2018 YTD)

Indicators of Compromise (IoCs)

Command-and-control (C&C) server IPs:

  • hxxps://5[.]61[.]47[.]74/batya/give.php
  • hxxps://103[.]242[.]117[.]248/batya/give.php
  • hxxps://mta116[.]megaonline[.]in
  • hxxps://czcmail[.]com (IP: 119[.]23[.]128[.]176)

Recent sample MD5s:

  • 180721A8551FBBCD763C320E7034E36C (WinGraph32.exe)
  • F44D28F852A99821B681C3EAF044C8D3 (OllyDbg.exe)

Interested in emerging security threats? Read the latest IBM X-Force Research

More from Banking & Finance

How the ZeuS Trojan Info Stealer Changed Cybersecurity

4 min read - Information stealer malware is a type of malicious software designed to collect sensitive information from a victim’s computer. Also known as info stealers, data stealers or data-stealing malware, this software is true to its name: after infecting a computer or device, it’s highly adept at exfiltrating login credentials, financial information and personal data. Info stealers typically operate by monitoring keyboard input, capturing screenshots and intercepting network traffic. They may also search a hard drive for specific types of data. The…

4 min read

2022 Industry Threat Recap: Finance and Insurance

5 min read - The finance and insurance sector proved a top target for cybersecurity threats in 2022. The IBM Security X-Force Threat Intelligence Index 2023 found this sector ranked as the second most attacked, with 18.9% of X-Force incident response cases. If, as Shakespeare tells us, past is prologue, this sector will likely remain a target in 2023. Finance and insurance ranked as the most attacked sector from 2016 to 2020, with the manufacturing sector the most attacked in 2021 and 2022. What…

5 min read

How to Spot a Nefarious Cryptocurrency Platform

4 min read - Do you ever wonder if your cryptocurrency platform cashes in ransomware payments? Maybe not, but it might be worth investigating. Bitcoin-associated ransomware continues to plague companies, government agencies and individuals with no signs of letting up. And if your platform gets sanctioned, you may instantly lose access to all your funds. What exchanges or platforms do criminals use to cash out or launder ransomware payments? And what implications does this have for people who use exchanges legitimately? Blacklisted Exchanges and Mixers…

4 min read

Kronos Malware Reemerges with Increased Functionality

6 min read - The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

6 min read