Phishing Campaign Linked with “Dyre” Banking Malware

Systems Affected

Threat Level

Overview

Since mid-October 2014, a phishing campaign has targeted a wide variety of recipients while employing the Dyre/Dyreza banking malware. Elements of this phishing campaign vary from target to target including senders, attachments, exploits, themes, and payload(s).[1][2] Although this campaign uses various tactics, the actor’s intent is to entice recipients into opening attachments and downloading malware.

Description

The Dyre banking malware specifically targets sensitive user account credentials. The malware has the ability to capture user login information and send the captured data to malicious actors.[3](link is external) Phishing emails used in this campaign often contain a weaponized PDF attachment which attempts to exploit vulnerabilities found in unpatched versions of Adobe Reader.[4](link is external)[5](link is external) After successful exploitation, a user's system will download Dyre banking malware. All of the major anti-virus vendors have successfully detected this malware prior to the release of this alert.[6](link is external)
Please note, the below listing of indicators does not represent all characteristics and indicators for this campaign.

Phishing Email Characteristics:
• Subject: "Unpaid invoic" (Spelling errors in the subject line are a characteristic of this campaign)
• Attachment: Invoice621785.pdf

System Level Indicators (upon successful exploitation):

• Copies itself under C:\Windows\[RandomName].exe
• Created a Service named "Google Update Service" by setting the following registry keys:
• HKLM\SYSTEM\CurrentControlSet\Services\googleupdate\ImagePath: "C:\WINDOWS\pfdOSwYjERDHrdV.exe"
• HKLM\SYSTEM\CurrentControlSet\Services\googleupdate\DisplayName: "Google Update Service"[7]

Impact

A system infected with Dyre banking malware will attempt to harvest credentials for online services, including banking services.

Solution/ Workarounds

  ✻  Update the latest version of the Mozilla's Firefox on Windows, Linux and Mac.

References

https://www.us-cert.gov/ncas/alerts/TA14-300A

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.