The banking Trojan Dyre has emerged in a new form. Threat Geek noted many similarities between Dyre and the TrickBot malware that targets banking information.

Dyre was seemingly shut down after authorities conducted a successful raid and apprehended the operators in November 2015. The malware’s authors, however, seem poised to make a comeback with this Trickbot Trojan.

TrickBot Malware: A Dyre Comeback

Security firm Fidelis Cybersecurity first discovered this malware in the wild in September 2016. The first part of the Trojan, called TrickLoader, has a method of operation that is very similar to Dyre’s. According to Fidelis, however, one must decode the malware to fully appreciate the similarities.

Analysis of the code shows that it is not simply a reuse of Dyre code, but a rewrite. For example, the bot interfaces with MSFT’s TaskScheduler through COM for its persistence rather than a direct run of commands. Where Dyre used a SHA-256 hashing routine inside its code, TrickBot utilizes Microsoft CryptoAPI. TrickBot also uses C++ , whereas Dyre mostly used C.

Furthermore, the custom crypter included in TrickLoader has shown up in analysis of the Vawtrak, Pushdo and Cutwail malware families. That is significant because Dyre used the Cutwail spambot to spread the Trojan. It seems the miscreants are trying to rebuild their Cutwail botnet.

All this evidence suggested that the malware developers rewrote the underlying Dyre code to create TrickBot. This led Fidelis to conclude that “one of more of the original developers of Dyre is involved with TrickBot.”

TrickBot Puts Australian Banks in Dyre Straits

SecurityWeek reported that the Trojan targeted the customers of several Australian banks. The Trojan’s configuration file also included the URL for the website of the Canadian Imperial Bank of Commerce (CIBC), but no direct attacks on CIBC have been discovered yet.

Initial TrickBot samples only had one functional module present, which was designed to record the system information of the infected device. Researchers spotted a new module in October that contained webinjects, but these appear to be in the developmental phase and not yet finalized.

It may take time for this malware to turn its attention to the U.S., but in the meantime users should brush up on mitigation techniques to avoid becoming a victim.

More from

The White House on Quantum Encryption and IoT Labels

A recent White House Fact Sheet outlined the current and future U.S. cybersecurity priorities. While most of the topics covered were in line with expectations, others drew more attention. The emphasis on critical infrastructure protection is clearly a top national priority. However, the plan is to create a labeling system for IoT devices, identifying the ones with the highest cybersecurity standards. Few expected that news. The topic of quantum-resistant encryption reveals that such concerns may become a reality sooner than…

Contain Breaches and Gain Visibility With Microsegmentation

Organizations must grapple with challenges from various market forces. Digital transformation, cloud adoption, hybrid work environments and geopolitical and economic challenges all have a part to play. These forces have especially manifested in more significant security threats to expanding IT attack surfaces. Breach containment is essential, and zero trust security principles can be applied to curtail attacks across IT environments, minimizing business disruption proactively. Microsegmentation has emerged as a viable solution through its continuous visualization of workload and device communications…

CEO, CIO or CFO: Who Should Your CISO Report To?

As we move deeper into a digitally dependent future, the growing concern of data breaches and other cyber threats has led to the rise of the Chief Information Security Officer (CISO). This position is essential in almost every company that relies on digital information. They are responsible for developing and implementing strategies to harden the organization's defenses against cyberattacks. However, while many organizations don't question the value of a CISO, there should be more debate over who this important role…

Malware-as-a-Service Flaunts Its Tally of Users and Victims

As time passes, the security landscape keeps getting stranger and scarier. How long did the “not if, but when” mentality towards cyberattacks last — a few years, maybe? Now, security pros think in terms of how often will their organization be attacked and at what cost. Or they consider how the difference between legitimate Software-as-a-Service (SaaS) brands and Malware-as-a-Service (MaaS) gangs keeps getting blurrier. MaaS operators provide web-based services, slick UX, tiered subscriptions, newsletters and Telegram channels that keep users…