Home Malware Programs Trojans Dyre/Dyreza Trojan

Dyre/Dyreza Trojan

Posted: June 17, 2014

Threat Metric

Threat Level: 9/10
Infected PCs: 35
First Seen: June 17, 2014
Last Seen: July 3, 2019
OS(es) Affected: Windows


The popularity of banking Trojans amongst ill-minded persons continues to breed new offshoots like the Dyreza Trojan, a new PC threat of this subtype handling its distribution via non-targeted e-mail messages. Through the widely-used exploit of browser-hooking attacks, the Dyreza Trojan intercepts Web data and is designed to use such attacks to compromise bank accounts, much like ZeuS and its famed 'man in the middle' functions. Due to the Dyreza Trojan's limited symptoms and its inclusion of self-defensive functions meant to block its deletion, malware researchers only can encourage removing a Dyreza Trojan through the use of appropriate and fully-patched brands of anti-malware tools.

The Latest Trojan Heist of Online Banking Institutions

After enormous media attention through famous banking Trojans like ZeuS, the general public has had increased awareness of the existence of man-in-the-middle or man-in-the-browser attacks. These attacks are able to collect even SSL-encrypted information, and rarely show evidence of their existence to tip their victims off to the problem. The Dyreza Trojan is a recently-identified Trojan to make use of these same types of attacks, which base themselves on injecting threatening code into your browser's memory process (or 'hooking' it). At this time, Chrome, Firefox and Internet Explorer may be affected by a Dyreza Trojan.

The Dyreza Trojan, also known as Dyre, keeps track of your Web traffic and monitors both input into the browser and which sites you visit. The Dyreza Trojan especially may monitor online banking sites, including ones for the following companies:

  • Bank of America
  • Citigroup
  • Natwest
  • The Royal Bank of Scotland
  • Ulsterbank

These attacks snatch passwords, login names and other, equally important information, including data with the protection of encryption. The data is transferred in plain text through the Dyreza Trojan's backdoor connection, which also may accept instructions on how to modify your browser's behavior or conduct other attacks. Although the PC user no longer is interacting with the official bank website, there are no symptoms from the Dyreza Trojan to indicate this massive breach of security.

Of course, malware experts rate the potential for bank account hijacks and fraudulent financial transactions to be extremely high. However, the Dyreza Trojan's network connection also may be used for other, equally threatening ends, like installing new threats.

Preventing a Dire Trojan from Taking Your Payday

The Dyreza Trojan uses both code obfuscation techniques and data compression to prevent PC security tools from recognizing the Dyreza Trojan, although malware experts have found reasonable detection rates of the Dyreza Trojan from updated anti-malware products. However, besides the obvious use of anti-malware tools for deleting a Dyreza Trojan, your bank accounts, naturally, are safer when you can prevent the Dyreza Trojan from compromising your PC at all.

When it comes to the latter, malware researchers recommend avoiding Flash 'updates' from suspicious pop-ups and sites that could include unsafe, script-based content, that may be the ones to be blamed for a wide extent of threat installers. The Dyreza Trojan campaign also makes especially heavy use of spam e-mail messages, which, tellingly, are disguised to resemble bank notifications and warnings about rejected tax payments. PC users who aren't susceptible to downloading ZIP-based file attachments from these sources shouldn't expect themselves to be easily targeted by the Dyreza Trojan's current distribution tactics.

Aliases

Crypt3.BWFI [AVG]W32/Upatre.HN!tr [Fortinet]Trojan.Inject [Ikarus]Trj/Genetic.gen [Panda]Trojan/Win32.Waski [AhnLab-V3]PWS:Win32/Dyzap [Microsoft]Troj/Dyreza-BD [Sophos]BehavesLike.Win32.Backdoor.gc [McAfee-GW-Edition]Trojan.Win32.Staser.gv [Kaspersky]Infostealer.Dyranges [Symantec]Upatre-FAAJ!97388A31E2E3 [McAfee]

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%WINDIR%\UVbvibqIfsBOGcD.exe File name: UVbvibqIfsBOGcD.exe
Size: 545.79 KB (545792 bytes)
MD5: b25cafa85213d906bee856a841dbae02
Detection count: 69
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%
Group: Malware file
Last Updated: July 3, 2015
%WINDIR%\smAyGCtgdvpVECw.exe File name: smAyGCtgdvpVECw.exe
Size: 421.37 KB (421376 bytes)
MD5: 97388a31e2e36b2bef2984e40e23f2f1
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%
Group: Malware file
Last Updated: January 29, 2015
Loading...