The banking Trojan Dyre has emerged in a new form. Threat Geek noted many similarities between Dyre and the TrickBot malware that targets banking information.

Dyre was seemingly shut down after authorities conducted a successful raid and apprehended the operators in November 2015. The malware’s authors, however, seem poised to make a comeback with this Trickbot Trojan.

TrickBot Malware: A Dyre Comeback

Security firm Fidelis Cybersecurity first discovered this malware in the wild in September 2016. The first part of the Trojan, called TrickLoader, has a method of operation that is very similar to Dyre’s. According to Fidelis, however, one must decode the malware to fully appreciate the similarities.

Analysis of the code shows that it is not simply a reuse of Dyre code, but a rewrite. For example, the bot interfaces with MSFT’s TaskScheduler through COM for its persistence rather than a direct run of commands. Where Dyre used a SHA-256 hashing routine inside its code, TrickBot utilizes Microsoft CryptoAPI. TrickBot also uses C++ , whereas Dyre mostly used C.

Furthermore, the custom crypter included in TrickLoader has shown up in analysis of the Vawtrak, Pushdo and Cutwail malware families. That is significant because Dyre used the Cutwail spambot to spread the Trojan. It seems the miscreants are trying to rebuild their Cutwail botnet.

All this evidence suggested that the malware developers rewrote the underlying Dyre code to create TrickBot. This led Fidelis to conclude that “one of more of the original developers of Dyre is involved with TrickBot.”

TrickBot Puts Australian Banks in Dyre Straits

SecurityWeek reported that the Trojan targeted the customers of several Australian banks. The Trojan’s configuration file also included the URL for the website of the Canadian Imperial Bank of Commerce (CIBC), but no direct attacks on CIBC have been discovered yet.

Initial TrickBot samples only had one functional module present, which was designed to record the system information of the infected device. Researchers spotted a new module in October that contained webinjects, but these appear to be in the developmental phase and not yet finalized.

It may take time for this malware to turn its attention to the U.S., but in the meantime users should brush up on mitigation techniques to avoid becoming a victim.

More from

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read

Heads Up CEO! Cyber Risk Influences Company Credit Ratings

4 min read - More than ever, cybersecurity strategy is a core part of business strategy. For example, a company’s cyber risk can directly impact its credit rating. Credit rating agencies continuously strive to gain a better understanding of the risks that companies face. Today, those agencies increasingly incorporate cybersecurity into their credit assessments. This allows agencies to evaluate a company’s capacity to repay borrowed funds by factoring in the risk of cyberattacks. Getting Hacked Impacts Credit Scoring As per the Wall Street Journal…

4 min read

Zombie APIs are a Top Security Concern as API Attacks Surge 400%

4 min read - Organizations of all sizes rely on application programming interfaces (APIs). The API explosion has been driven by several factors, including cloud computing, demand for mobile/web applications, microservices architecture and the API economy as a business model. APIs enable developers to access data remotely, integrate with other services, build modular applications and monetize their data/services. For enterprises that participated in a recent research study, the average number of APIs per organization was 15,564. Large enterprises (over 10,000 employees) had an average…

4 min read