Threat Descriptions

Trojan-Spy:W32/Shiotob

Classification

Category :

Malware

Type :

Trojan-Spy

Platform :

W32

Aliases :

Bebloh, URLZone

Summary

Shiotob, also known as URLZone or Bebloh, is a banking trojan which sends sensitive data to a command and control (C&C) server and receives commands to perform malicious operations.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Infection Vector

Commonly downloaded via malicious document that arrives as an attachment in a spam email.

Behavior

Shiotob injects malicious code into explorer.exe or iexplorer.exe and executes from there.

Stealth capability

The sample's execution will be terminated if the following conditions are met:

  • Running in debugger by checking the "Isdebuggerpresent" API
  • Running in VMware by checking the "VMWARE" string
  • The sample name is "SAMPLE", "VIRUS" or "SANDBOX"
  • If the processor of the computer is 'Xeon'
  • If the sample is run with command line and the arguments are either -aurnato or -udpid. If yes, it will then set a flag.

Dropped files

Shiotob creates a file in the location "C:\Program Files (x86)\Windows NT\<random>.exe"

(random filename based on these keywords: win, video, def, mem, dns, setup, user, logon, hlp, mixer, pack, mon, srv, exec, and play)

Registry changes

  • HKEY_LOCAL_MACHINE\SOFTWARE\<random name>:
    • REG_BINARY: {BINARY DATA}

Created Mutex

  • Global\Uz[A-Za-z0-9]{8}

Check proxy

Checks the proxy setting by searching \Mozilla\Firefox\Profiles\prefs.js

Network Activities

  • Checking internet connection by connecting to www[.]google[.]com
  • Connects to C2 server: olkerona[.]com/auth
  • C2 format:
    • olkerona[.]com/auth/?tver=[data]&vcmd=[data]&cc=[data]&hh=[data]&ipcnf=[data]&sckport=[data]&pros=[data]&keret=[data]&email=[data]
      • ipcnf = IP address
      • sckport = Sock port (proxy)
      • keret = Keyboard layout
      • email = Email address if any
      • Other fields &vcmd, &hh, &tver, &cc are related to C&C

Analysis based on sample: 0d8fd93b0b59ab2c3b41e2eadb1d9ea6f4dce9ea