The banking Trojan Dyre has emerged in a new form. Threat Geek noted many similarities between Dyre and the TrickBot malware that targets banking information.
Dyre was seemingly shut down after authorities conducted a successful raid and apprehended the operators in November 2015. The malware’s authors, however, seem poised to make a comeback with this Trickbot Trojan.
TrickBot Malware: A Dyre Comeback
Security firm Fidelis Cybersecurity first discovered this malware in the wild in September 2016. The first part of the Trojan, called TrickLoader, has a method of operation that is very similar to Dyre’s. According to Fidelis, however, one must decode the malware to fully appreciate the similarities.
Analysis of the code shows that it is not simply a reuse of Dyre code, but a rewrite. For example, the bot interfaces with MSFT’s TaskScheduler through COM for its persistence rather than a direct run of commands. Where Dyre used a SHA-256 hashing routine inside its code, TrickBot utilizes Microsoft CryptoAPI. TrickBot also uses C++ , whereas Dyre mostly used C.
Furthermore, the custom crypter included in TrickLoader has shown up in analysis of the Vawtrak, Pushdo and Cutwail malware families. That is significant because Dyre used the Cutwail spambot to spread the Trojan. It seems the miscreants are trying to rebuild their Cutwail botnet.
All this evidence suggested that the malware developers rewrote the underlying Dyre code to create TrickBot. This led Fidelis to conclude that “one of more of the original developers of Dyre is involved with TrickBot.”
TrickBot Puts Australian Banks in Dyre Straits
SecurityWeek reported that the Trojan targeted the customers of several Australian banks. The Trojan’s configuration file also included the URL for the website of the Canadian Imperial Bank of Commerce (CIBC), but no direct attacks on CIBC have been discovered yet.
Initial TrickBot samples only had one functional module present, which was designed to record the system information of the infected device. Researchers spotted a new module in October that contained webinjects, but these appear to be in the developmental phase and not yet finalized.
It may take time for this malware to turn its attention to the U.S., but in the meantime users should brush up on mitigation techniques to avoid becoming a victim.