IBM X-Force researchers analyzed the activity of a relatively new banking Trojan known as BackSwap. BackSwap emerged in March 2018 and, until recently, had only targeted Polish banks. The malware’s target list now features six major banks in Spain.

According to X-Force analysis, BackSwap is its own malware project, but it is based on features that existed within the Tinba Trojan. The malware’s operators keep the code as their own project; in that sense, it is considered gang-owned and not commercial malware.

A Twist in the Tale

Overall, BackSwap is no more sophisticated than any other active banking Trojan. Its highlight is its webinjection mechanism. Instead of using the more common method of hooking browser functions, then creating different versions for each architecture, BackSwap injects JavaScript into the address bar.

By simulating user input to access the browser’s address bar and inserting the malicious script directly there, BackSwap can execute the script using JavaScript protocol URLs and bypass protections of both the browser and the bank’s third-party security controls.

In terms of what BackSwap does with the injections, this is where the novelty ends. Just as malware such as Zeus has been doing for over a decade, BackSwap uses malicious scripts to modify what victims see on their bank’s website in classic man-in-the-browser (MitB) style:

  • Scripts wait for a minimum amount of data to be transferred before replacing the destination account number.
  • Scripts inject mule account numbers on the fly via MitB.
  • Scripts hide the mule account number that the money will go to and instead present the original destination account the victim entered.

BackSwap’s Fraud Method

The likely fraud scenario based on BackSwap’s capabilities is in-session fraud automated by MitB malware scripts. The malware’s scripts wait for the user to go to a page where a transaction is to take place. When the victim initiates activity that’s interesting to the attacker, such as adding a payee or starting a money transfer, the malware replaces the destination account with a mule account number.

Figure 1: The BackSwap function responsible for account number replacement

Using MitB scripts to alter transaction details sent to the bank is not a new method. What’s new here is the way BackSwap implements it to circumvent third-party security on the bank’s website. This method can be more successful with banks that don’t require two-factor authentication (2FA) or out-of-band transaction authorization (OOBA) from customers moving money to other accounts.

Malware Spam and Then Some

BackSwap is most often delivered to users via malware spam, concealed in an attachment of a productivity file like Microsoft Word or bundled inside other programs. BackSwap favors popular freeware or open source programs and plants its code in the initialization phase of the program. When run during an early stage of the program’s execution, the code replaces the installation routine with malicious instructions that execute BackSwap instead. One interesting choice was Ollydbg.exe, which is a program often used by malware researchers.

Testing Attack Turfs

The malware’s attack scope has thus far been limited to a few banks in Poland and some banks in Spain, specifically targeting personal banking.

The limited number of banks in each country so far may suggest that BackSwap is still in testing. Our research team expects to see more testing in other geographies in the coming weeks, and possibly a wider scope of attack for this Trojan in the fourth quarter of 2018.

Will we see BackSwap on the top 10 list of financial malware in 2019? IBM X-Force will keep updating its information on BackSwap via the X-Force Exchange.

Figure 2: Top most prevalent financial malware families (2018 YTD)

Indicators of Compromise (IoCs)

Command-and-control (C&C) server IPs:

  • hxxps://5[.]61[.]47[.]74/batya/give.php
  • hxxps://103[.]242[.]117[.]248/batya/give.php
  • hxxps://mta116[.]megaonline[.]in
  • hxxps://czcmail[.]com (IP: 119[.]23[.]128[.]176)

Recent sample MD5s:

  • 180721A8551FBBCD763C320E7034E36C (WinGraph32.exe)
  • F44D28F852A99821B681C3EAF044C8D3 (OllyDbg.exe)

Interested in emerging security threats? Read the latest IBM X-Force Research

More from Malware

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed ITG05…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today