Don’t accept the wire transfer. That’s the word from Microsoft’s Malware Protection Center, which recently uncovered a spam campaign spreading the notorious Trojan:Win32/Upatre downloader. Upatre has made the rounds before, trying to worm its way onto user systems through email and steal banking credentials. This time, however, the downloader comes with Dyreza, a notorious Trojan. With malware now going for broke, how do users stay in the black?
Banking on Acceptance
The emails from Upatre spammers aren’t particularly impressive, with most telling users they have been wired $35,292.00 and that claiming the money is as simple as opening the attached file, often named payment1872.zip. However, doing so redirects to either a continua.ltd.uk domain or an odecarequipa.com domain, where encrypted components containing PWS:Win32/Dyzap..H are downloaded, which is a variant on the original Dyreza. According to Microsoft, this threat was seen predominantly in the United States and Canada, with 77 percent and 14 percent of all Upatre detections, respectively. The rest of the world accounted for only 9 percent.
So what’s the big deal with Dyreza? As noted by Threatpost, this malware is extremely dangerous because it can bypass secure socket layer (SSL) encryption using a technique known as “browser hooking.” This intercepts all traffic flowing between a user’s machine and a legitimate website and works on any of the three major browsers: Chrome, Firefox and Internet Explorer. This allows it to steal banking credentials without triggering any warnings on either the host machine or the bank server. Once compromised, the malware contacts a command-and-control center every time a device is restarted.
A Long History
Both Upatre and Dyreza have been active this year. In September, Softpedia reported that a new form of Upatre had been detected, supposedly originating from a legitimate financial institution. Just last week, Upatre was spotted in a spam email claiming to be from a law firm investigating police actions in Ferguson, Missouri.
Dyreza, meanwhile, is described as one of today’s top five malware threats by eSecurity Planet, which notes that Bank of America, the Royal Bank of Scotland, Citibank, Ulster Bank and NatWest have all been targeted. At the end of November, the malware was busy exploiting vulnerability CVE-2014-4114 in Windows. With a track record of success for both pieces of software, it’s unlikely that either will see a slowdown in the near future, meaning users must be cognizant of potential risks.
The easiest way to stay safe? Don’t accept the wire transfer. There is no such thing as free money, especially when it comes in the amount of $35,000. No matter how well-worded the email or tempting the stash of funds, any message that asks users to download an attachment from a website redirect is bad news. As recent attempts indicate, the bait may not always be financial. Cybercriminals aren’t above using national or international issues as bait to convince users that a click is both necessary and safe.
The bottom line? If it seems too good to be true, it probably is. Avoid Upatre, avoid Dyreza, and don’t get hooked by spam.