IBM X-Force researchers analyzed the activity of a relatively new banking Trojan known as BackSwap. BackSwap emerged in March 2018 and, until recently, had only targeted Polish banks. The malware’s target list now features six major banks in Spain.
According to X-Force analysis, BackSwap is its own malware project, but it is based on features that existed within the Tinba Trojan. The malware’s operators keep the code as their own project; in that sense, it is considered gang-owned and not commercial malware.
A Twist in the Tale
In terms of what BackSwap does with the injections, this is where the novelty ends. Just as malware such as Zeus has been doing for over a decade, BackSwap uses malicious scripts to modify what victims see on their bank’s website in classic man-in-the-browser (MitB) style:
- Scripts wait for a minimum amount of data to be transferred before replacing the destination account number.
- Scripts inject mule account numbers on the fly via MitB.
- Scripts hide the mule account number that the money will go to and instead present the original destination account the victim entered.
BackSwap’s Fraud Method
The likely fraud scenario based on BackSwap’s capabilities is in-session fraud automated by MitB malware scripts. The malware’s scripts wait for the user to go to a page where a transaction is to take place. When the victim initiates activity that’s interesting to the attacker, such as adding a payee or starting a money transfer, the malware replaces the destination account with a mule account number.
Figure 1: The BackSwap function responsible for account number replacement
Using MitB scripts to alter transaction details sent to the bank is not a new method. What’s new here is the way BackSwap implements it to circumvent third-party security on the bank’s website. This method can be more successful with banks that don’t require two-factor authentication (2FA) or out-of-band transaction authorization (OOBA) from customers moving money to other accounts.
Malware Spam and Then Some
BackSwap is most often delivered to users via malware spam, concealed in an attachment of a productivity file like Microsoft Word or bundled inside other programs. BackSwap favors popular freeware or open source programs and plants its code in the initialization phase of the program. When run during an early stage of the program’s execution, the code replaces the installation routine with malicious instructions that execute BackSwap instead. One interesting choice was Ollydbg.exe, which is a program often used by malware researchers.
Testing Attack Turfs
The malware’s attack scope has thus far been limited to a few banks in Poland and some banks in Spain, specifically targeting personal banking.
The limited number of banks in each country so far may suggest that BackSwap is still in testing. Our research team expects to see more testing in other geographies in the coming weeks, and possibly a wider scope of attack for this Trojan in the fourth quarter of 2018.
Will we see BackSwap on the top 10 list of financial malware in 2019? IBM X-Force will keep updating its information on BackSwap via the X-Force Exchange.
Figure 2: Top most prevalent financial malware families (2018 YTD)
Indicators of Compromise (IoCs)
Command-and-control (C&C) server IPs:
- hxxps://czcmail[.]com (IP: 119[.]23[.]128[.]176)
Recent sample MD5s:
- 180721A8551FBBCD763C320E7034E36C (WinGraph32.exe)
- F44D28F852A99821B681C3EAF044C8D3 (OllyDbg.exe)