# MA-462.032015: MyCERT Alert - Dyre Banking Malware

**Date:** 26 Mar 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-462.032015  
**Advisory ID:** MA-462.032015

---

#### **1.0 Introduction**
MyCERT have received information from valid sources and made aware of malicious program called Dyre aka Dyreza that target online banking users, similar to Zeus/Citadel banking trojan. Dyre is part of a phishing campaign targeting online banking user using various method including senders, attachments and exploits. This campaign uses various techniques to force victim into opening the email attachment and downloading the malware.
**2.0 System Affected**
Any Microsoft Windows operating system.
**3.0 Impacts**
The following are the impacts the malware:
- The malware can capture victim’s credentials.
- The stolen credentials most likely will be sold in underground economy.
**4.0 Technical Descriptions**
The main objective of this campaign is typically to capture user login information and send the obtained data to malicious actors.Phishing emails used in this campaign often contain a malicious PDF attachment which attempts to exploit vulnerabilities found in unpatched versions of Adobe Reader.
DYRE waits for users to access any of the targeted website before carrying out its information stealing routines.
The following are the malware capabilities:
- Download a worm that is capable of composing email messages in Microsoft Outlook.This worm hijacks Microsoft Outlook to compose e-mail messages with the UPATRE malware attached and sent to email addresses received from C2 server.UPATRE will download new variant of DYRE if executed by the receiver of the email.
- Communicate with C2 server from I2P address similar to CryptoWall 3.0 . This address is inaccessible from regular web browser.
- Usie Domain Generation Algorithm (DGA) to generate URL by producing 34-character string appended to one of the six top level domains (TLD): .cc, .ws,  .to, .in, .hk, .cn, .tk
**4.1 Phishing Email Subject:**
- “Wire transfer receive”
- “Medicines here”
- “Complaint against your company”
- “Payment Advice - advice Ref:[xxxxxx]/CHAPS credits”
- “Company repor”   - (note the missing t in “report")
- “Wire transfer complete”
- “Important â€“ New Outlook Settings”
- “Your Documen” - (note the missing t in “Document")
- “Voice Message”
- “Employee Documents â€“ Internal Use”
- “Fwd Wire Payment”
**4.2 System Registry and Files**
- Copies itself under C:\Windows\[RandomName].exe
- Created a Service named ""Google Update Service” by setting the following registry keys:
- HKLM\SYSTEM\CurrentControlSet\Services\googleupdate\ImagePath: "C:\WINDOWS\pfdOSwYjERDHrdV.exe"
- HKLM\SYSTEM\CurrentControlSet\Services\googleupdate\DisplayName: "Google Update Service"
**4.3 Network activities**
The Dyre malware communicate with several C2 servers using an encrypted SSL connection. The following is C2 IP addresses:
- 109.236.84.101
- 178.47.141.100
- 202.153.35.133
- 31.43.236.251
- 92.240.99.70
- 94.41.208.125
The following list is payload URL that contains malicious code program:
- hxxp://aaepablog.com/aaepa/inst\_s12.pdf (IP: 50.87.144.171)
- hxxp://acmeeconnect.com/dropbox/ml1from2.tar (IP: 107.190.133.12)
- hxxp://aixact.com/Docs/ml1from2.tar (IP: 213.186.33.19)
- hxxp://allcommerc.com/wp-includes/pomo/eulaa.pdf (IP: 62.149.144.49)
- hxxp://www.onoranzefunebricarrara.it/public/eulaa.pdf (IP: 62.149.128.151, 62.149.131.204)
- hxxp://angkosoteknologi.co.id/fonts/manualac.pdf (IP: 23.92.215.218)
- hxxp://cgksolutions.com/files/manualac.pdf (IP: 62.149.128.166, 62.149.140.202)
- hxxp://creazionidarte.it/mandoc/seo21.pdf (IP: 62.149.128.74, 62.149.131.67)
- hxxp://cwvancouver.com/cp/images/digits/arrowu.jpg (IP: 71.18.62.202)
- hxxp://dipford.com/mandoc/info22.pdf (IP: 209.235.144.9)
- hxxp://dms-online-files.com/pdfs/prewa.pdf (IP: 206.188.192.13)
- hxxp://ettfire.com/js/ml2from2.tar (IP: 66.175.58.9)
- hxxp://gumtek.com/wp-includes/pomo/sw\_docb.pdf (IP: 50.87.148.213)
- hxxp://harveyouellet.com/TOXICOUSTIQUE/arrowu.jpg (IP: 192.185.35.92)
- hxxp://houndsofcullen.com/mandoc/eula022.pdf (IP: 198.136.54.104)
- hxxp://manualtatex.com/mandoc/eula022.pdf (IP: 69.49.115.33)
- hxxp://marodz.republika.pl/1/manualec.pdf (IP: 213.180.150.17)
- hxxp://metflex.uk.com/images/t\_image.jpg (IP: 91.103.217.10)
- hxxp://tickto.com/apk/ml1from2.tar (IP: 50.23.103.91)
- hxxp://posharpstore.com/Google/ml1from2.tar (IP: 162.254.162.184)
- hxxp://utokatalin.ro/administrator/ml2from2.tar (IP: 86.106.30.102)
- hxxp://vimax-marireapenisului.ro/docuv.pdf (IP: 195.78.124.14)
- hxxp://rx-liquid.ro/docuv.pdf (IP: 195.78.124.14)
- hxxp://washcount.org/Documentation/file\_u21.pdf (IP: 216.224.135.21)
- hxxp://www.geothermole.com/mandoc/gb\_eule.pdf (IP: 81.21.76.62)
- hxxp://www.wholesalesyntheticmotoroil.com/mandoc/story\_su21.pdf (IP: 192.163.217.66)
- hxxp://zac-buero.de/mandoc/ml1from1.tar (IP: 78.143.39.41)
- hxxp://best-synthetic-motor-oil.com/file\_k12.pdf (IP: 192.163.217.66)
**5.0 Recommendations**
Some of the preventive measures that users can take against the DYRE malware infection are:
- Implement filters at your email gateway for filtering out emails with known Dyre subject lines.
- Block and log attempted connections to malware download site, payload download sites and C2 infrastructure.
- Always update their computers with latest patches and security fixes.
- Install an Anti-virus software in their computers and keep it up to date with latest signatures.
- Users must not click unsolicited web links and attachments in email messages.
- Users must always keep their browsers updated with latest patches.
- User must keep away from installing counterfeit software as they may bring along with malware.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#2f42564c4a5d5b6f42564c4a5d5b01405d48014256)
Phone :  1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/) 
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**6.0 Reference**
- <https://www.us-cert.gov/ncas/alerts/TA14-300A>
- <http://securityintelligence.com/dyre-banking-trojan-used-in-apt-style-attacks-against-enterprises/>
- [http://www.cisecurity.org/cyber-alerts/2015/02232015.cfm](http://securityintelligence.com/dyre-banking-trojan-used-in-apt-style-attacks-against-enterprises/)