October 18, 2016 By Larry Loeb 2 min read

The banking Trojan Dyre has emerged in a new form. Threat Geek noted many similarities between Dyre and the TrickBot malware that targets banking information.

Dyre was seemingly shut down after authorities conducted a successful raid and apprehended the operators in November 2015. The malware’s authors, however, seem poised to make a comeback with this Trickbot Trojan.

TrickBot Malware: A Dyre Comeback

Security firm Fidelis Cybersecurity first discovered this malware in the wild in September 2016. The first part of the Trojan, called TrickLoader, has a method of operation that is very similar to Dyre’s. According to Fidelis, however, one must decode the malware to fully appreciate the similarities.

Analysis of the code shows that it is not simply a reuse of Dyre code, but a rewrite. For example, the bot interfaces with MSFT’s TaskScheduler through COM for its persistence rather than a direct run of commands. Where Dyre used a SHA-256 hashing routine inside its code, TrickBot utilizes Microsoft CryptoAPI. TrickBot also uses C++ , whereas Dyre mostly used C.

Furthermore, the custom crypter included in TrickLoader has shown up in analysis of the Vawtrak, Pushdo and Cutwail malware families. That is significant because Dyre used the Cutwail spambot to spread the Trojan. It seems the miscreants are trying to rebuild their Cutwail botnet.

All this evidence suggested that the malware developers rewrote the underlying Dyre code to create TrickBot. This led Fidelis to conclude that “one of more of the original developers of Dyre is involved with TrickBot.”

TrickBot Puts Australian Banks in Dyre Straits

SecurityWeek reported that the Trojan targeted the customers of several Australian banks. The Trojan’s configuration file also included the URL for the website of the Canadian Imperial Bank of Commerce (CIBC), but no direct attacks on CIBC have been discovered yet.

Initial TrickBot samples only had one functional module present, which was designed to record the system information of the infected device. Researchers spotted a new module in October that contained webinjects, but these appear to be in the developmental phase and not yet finalized.

It may take time for this malware to turn its attention to the U.S., but in the meantime users should brush up on mitigation techniques to avoid becoming a victim.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today