News

Extraordinary Robot
Robot
Joined
Jun 27, 2006
Messages
23,048
Original release date: October 27, 2014
Systems Affected


Microsoft Windows

Overview


Since mid-October 2014, a phishing campaign has targeted a wide variety of recipients while employing the Dyre/Dyreza banking malware. Elements of this phishing campaign vary from target to target including senders, attachments, exploits, themes, and payload(s).Link Removed[2] Although this campaign uses various tactics, the actor’s intent is to entice recipients into opening attachments and downloading malware.

Description


The Dyre banking malware specifically targets sensitive user account credentials. The malware has the ability to capture user login information and send the captured data to malicious actors.[3] Phishing emails used in this campaign often contain a weaponized PDF attachment which attempts to exploit vulnerabilities found in unpatched versions of Adobe Reader.[4][5] After successful exploitation, a user's system will download Dyre banking malware. All of the major anti-virus vendors have successfully detected this malware prior to the release of this alert.[6]

Please note, the below listing of indicators does not represent all characteristics and indicators for this campaign.

Phishing Email Characteristics:

  • Subject: "Unpaid invoic" (Spelling errors in the subject line are a characteristic of this campaign)
  • Attachment: Invoice621785.pdf

System Level Indicators (upon successful exploitation):

  • Copies itself under C:\Windows\[RandomName].exe
  • Created a Service named "Google Update Service" by setting the following registry keys:
    • HKLM\SYSTEM\CurrentControlSet\Services\googleupdate\ImagePath: "C:\WINDOWS\pfdOSwYjERDHrdV.exe"
    • HKLM\SYSTEM\CurrentControlSet\Services\googleupdate\DisplayName: "Google Update Service"
Impact


A system infected with Dyre banking malware will attempt to harvest credentials for online services, including banking services.

Solution


Users and administrators are recommended to take the following preventive measures to protect their computer networks from phishing campaigns:

  • Do not follow unsolicited web links in email. Refer to the Link Removed Link Removed for more information on social engineering attacks.
  • Use caution when opening email attachments. For information on safely handling email attachments, see Link Removed.Link Removed
  • Follow safe practices when browsing the web. See Link Removed Link Removedand Link Removed Link Removedfor additional details.
  • Maintain up-to-date anti-virus software.
  • Keep your operating system and software up-to-date with the latest patches.

US-CERT collects phishing email messages and website locations so that we can help people avoid becoming victims of phishing scams.

You can report phishing to us by sending email to [email protected].

References

Revision History

  • October 27, 2014: Initial Release

This product is provided subject to this Link Removed and this Link Removed policy.

Link Removed
 


Back
Top