Dyreza : nouveau Trojan.Banker

[Malekal_morte]

Dyreza, un nouveau Trojan.Banker, ce dernier serait très actif en Grande Bretagne.
https://www.csis.dk/en/csis/news/4262/
Une bonne analyse ici : http://phishme.com/project-dyre-new-rat ... asses-ssl/

Ce dernier est capable de voler les identifiants bancaires sans éveiller de soupçon de la part de l'utilisation (pas d'erreur HTTPS ou autres).

Pour cela, un hook au niveau des navigateurs WEB est effectué afin de redirigé le traffic vers le malware qui va ensuite effectuer la connexion au site de la banque.
Le Malware agit donc comme un proxy afin de récupérer le traffic en clair (dont les identifiants).

Cette technique n'est pas nouvelle puisque le Trojan Caperb l'utilisait déjà.

[brandodu31]

comment se prevenir de ce genre de cochonneries?

[Malekal_morte]

Salut,

Comme la majorité des menaces => http://forum.malekal.com/comment-securi ... ateur.html

[brandodu31]

merci !

donc les mesures de securité habituelles !
j utilise trafficlight en plus avec firefox , je pense qu il est tres bien .
avira safety browser semble etre pas mal mais je ne l ai pas utilisé.

j utilise hitmanpro alert qui me securise opera 12.

[Malekal_morte]

faut pas non plus 50 protections!

[Malekal_morte]

En plus des campagnes de ransomwares CTB-Locker et CryptoWall - Le Trojan.Upatre

Exemple d'un mail en anglais qui se fait passer pour Bank of America CashPro Online



La détection : https://www.virustotal.com/fr/file/5387 ... 423238721/

SHA256: 5387585bc905f6304b190493af158a714bdd0baed1be7e81db40407d4a92af01
Nom du fichier : docs.exe
Ratio de détection : 3 / 56
Date d'analyse : 2015-02-06 16:05:21 UTC (il y a 1 minute)

Antivirus Résultat Mise à jour
Kaspersky UDS:DangerousObject.Multi.Generic 20150206
McAfee Downloader-FSH!1D38C362198A 20150206
Norman Upatre.FH 20150206

qui va télécharger Trojan.Dyre / Trojan.Dyreza : https://www.virustotal.com/fr/file/cee5 ... /analysis/

SHA256: cee50568b3219984dddd19622a928f6ba92ac768b375c9817c5518ba263cfa6b
Nom du fichier : cee50568b3219984dddd19622a928f6ba92ac768b375c9817c5518ba263cfa6b.exe
Ratio de détection : 2 / 56
Date d'analyse : 2015-02-06 16:06:43 UTC (il y a 11 minutes)

Qihoo-360 HEUR/QVM02.0.Malware.Gen 20150206
Tencent Win32.Trojan.Inject.Auto 20150206

Les sites de banques visés par le banker :

Code : Tout sélectionner

access.jpmorgan.com/*
access.jpmorgan.com/jpmalogon*
access.usbank.com/*
access.usbank.com/cpsApp1/AxolPreAuthServlet*
accounts.expresscoin.com/*
accounts.expresscoin.com/login*
achieveaccess.charterone.com/*
achieveaccess.charterone.com/exchange/basic/authentication*
admin.epymtservice.com/*
admin.epymtservice.com/admin/index.jhtml*
aibinternetbanking.aib.ie/*
aibinternetbanking.aib.ie/inet/roi/login.htm*
alolb1.arbuthnotlatham.co.uk/*
alolb1.arbuthnotlatham.co.uk/IB/Online*
an.rbcnetbank.com/*
an.rbcnetbank.com/*
anxbtc.com/*
anxbtc.com/*
ap.ebs.bankofchina.com/*
ap.ebs.bankofchina.com/login.html*
apps.bhw.de/*
apps.bhw.de/es600/index.jsp*
apps.virginmoney.com/*
apps.virginmoney.com/vmosws/loginWait.do*
auth.globalpay.westernunion.com/*
auth.globalpay.westernunion.com/Sso/Login.aspx*
bank.barclays.co.uk/*
bank.barclays.co.uk/olb/auth/LoginLink.action*
banking.bankhaus-mayer.de/*
banking.bankhaus-mayer.de/ptlweb/WebPortal*
banking.bankofscotland.co.uk/*
banking.bankofscotland.co.uk/Logon/Logon.aspx*
banking.bmwbank.de/*
banking.bmwbank.de/s/b2cpws.fcc*
banking.commerzfinanz.com/*
banking.commerzfinanz.com/onlinebanking-cfg/loginFormAction.do*
banking.degussa-bank.de/*
banking.degussa-bank.de/banking/servlet/com.pagentix.banking.servlet.TopNavigationServlet*
banking.donner-reuschel.de/*
banking.donner-reuschel.de/index.jsp*
banking.ing-diba.de/*
banking.ing-diba.de/app/login*
banking.ireland-bank.com/*
banking.ireland-bank.com/IrelandBankOnline_303/Authentication/Login.aspx*
banking.lloydsbank.com/*
banking.lloydsbank.com/Logon/logon.aspx*
banking.martinbank.de/*
banking.martinbank.de/*
banking.nfbank.de/*
banking.nfbank.de/ptlweb/WebPortal*
banking.oyakankerbank.de/*
banking.oyakankerbank.de/*
banking.steylerbank.de/*
banking.steylerbank.de/ptlweb/WebPortal*
banking.triodos.co.uk/*
banking.triodos.co.uk/*
banking.triodos.co.uk/*
banking.triodos.co.uk/ib-seam/login.seam?lcid=*
banking.triodos.co.uk/ib-seam/login.seam?loginType=dp550*
banking.triodos.co.uk/ib-seam/login.seam?loginType=username*
banking.valovisbank.de/*
banking.valovisbank.de/portal/*
bankofirelandlifeonline.ie/*
bankofirelandlifeonline.ie/*
bankonweb.sgeb.bg/*
bankonweb.sgeb.bg/*
bankonweb.sgeb.bg/page/default.aspx*
bankonweb.sgeb.bg/page/default.aspx*
bank.ruralbank.com.au/*
bank.ruralbank.com.au/banking/RBLIBanking*
banque.bfcoi.com/*
banque.bfcoi.com/identificationClient.html*
banques.exalog.net/*
banques.exalog.net/authent.php*
bbonline.bankofmelbourne.com.au/*
bbonline.bankofmelbourne.com.au/html/cbank.asp*
bbonline.banksa.com.au/*
bbonline.banksa.com.au/html/cbank.asp*
bbonline.stgeorge.com.au/*
bbonline.stgeorge.com.au/*
bbonline.stgeorge.com.au/html/cbank.asp*
bbonline.stgeorge.com.au/html/cbindex.asp*
bitbargain.co.uk/*
bitbargain.co.uk/login*
bitpay.com/*
bitpay.com/merchant-login*
blcweb.banquelaurentienne.ca/*
blcweb.banquelaurentienne.ca/*
blcweb.banquelaurentienne.ca/lang/en/BLCDirect*
blcweb.banquelaurentienne.ca/lang/fr/BLCDirect*
blockchain.info/*
blockchain.info/wallet/login*
bolpp.bankofireland.com/*
bolpp.bankofireland.com/Commercial*
bol.westpac.co.nz/*
bol.westpac.co.nz/s1gcb/logon/sbuser*
btultra.btrl.ro/*
btultra.btrl.ro/sign/_mcologon*
bureau.bottomline.co.uk/*
bureau.bottomline.co.uk/unity/index.aspx*
business2.danskebank.co.uk/*
business2.danskebank.co.uk/pub/logon/logon.aspx*
business2.danskebank.ie/*
business2.danskebank.ie/pub/logon/logon.aspx*
businessaccess.citibank.citigroup.com/*
businessaccess.citibank.citigroup.com/cbusol/signon.do*
businessbankingcpo.tdcommercialbanking.com/*
businessbankingcpo.tdcommercialbanking.com/WBB/LoginDisplay*
businesscenter.mysynchrony.com/*
businesscenter.mysynchrony.com/BusinessCenterPortal*
business.co-operativebank.co.uk/*
business.co-operativebank.co.uk/corp/BANKAWAY*
business-eb.ibanking-services.com/*
business-eb.ibanking-services.com/K1/index.jsp*
businessonline.mutualofomahabank.com/*
businessonline.mutualofomahabank.com/cb/pages/jsp-ns/login.jsp*
businessonline.westpac.com.au/*
businessonline.westpac.com.au/esis/Login/SrvPage*
business.santander.co.uk/*
business.santander.co.uk/LGSBBI_NS_ENS/BtoChannelDriver.ssobto*
butterfieldonline.co.uk/*
butterfieldonline.co.uk/*
cardonebanking.com/*
cardonebanking.com/*
cardonebanking.com/authlogin.aspx
cardonebanking.com/authlogin.aspx?business*
cashmanagement.barclays.net/*
cashmanagement.barclays.net/portalservices/forms/login.pser*
cashmanager.mizuhoe-treasurer.com/*
cashmanager.mizuhoe-treasurer.com/mz/servlet/SLogin*
cashproonline.bankofamerica.com/*
cashproonline.bankofamerica.com/AuthenticationFrameworkWeb/cpo/login/public/loginMain.faces*
catalystcorp.org/*
catalystcorp.org/*
cbfm.saas.cashfac.com/*
cbfm.saas.cashfac.com/cbfm/Logon.aspx*
cbionline.cbi.ae/*
cbionline.cbi.ae/bus/security/Welcome.do*
charisma.btdirect.ro/*
charisma.btdirect.ro/CharismaWEB/_Public/Login.aspx*
cib.bankofthewest.com/*
cib.bankofthewest.com/K1/servlet/com.fis.authentication.servlet.WelcomeServlet*
cib.icicibank.com/*
cib.icicibank.com/corp/BANKAWAY*
cib.uab.ae/*
cib.uab.ae/*
cityntl.webcashmgmt.com/*
cityntl.webcashmgmt.com/wcmfd/wcmpw/CustomerLogin*
clientlogin.ibb.ubs.com/*
clientlogin.ibb.ubs.com/login*
clientportal.ibb.ubs.com/*
clientportal.ibb.ubs.com/portal/index.htm*
clients.tilneybestinvest.co.uk/*
clients.tilneybestinvest.co.uk/ORM/Login.aspx*
cmbdirect.cmbnv.com/*
cmbdirect.cmbnv.com/business/online*
cmo.cibc.com/*
cmo.cibc.com/wp/wps/portal/bbdsignon*
cmol.bbt.com/*
cmol.bbt.com/auth/prompt.tb*
commerceconnections.commercebank.com/*
commerceconnections.commercebank.com*
commercial.bnc.ca/*
commercial.bnc.ca/auth/Login*
connect.bnymellon.com/*
connect.bnymellon.com/ConnectLogin/login/LoginPage.jsp*
connect-ch2.ubs.com/*
connect-ch2.ubs.com/workbench/Index.do*
corporate.adcb.com/*
corporate.adcb.com/corporateWeb/login.do*
corporate.metrobankonline.co.uk/*
corporate.metrobankonline.co.uk/*
corporate.santander.co.uk/*
corporate.santander.co.uk/LOGSCU_NS_ENS/BtoChannelDriver.bto*
dashboard.gocoin.com/*
dashboard.gocoin.com/login*
db-direct.db.com/*
db-direct.db.com/u/eb/Login_Main.serv*
db-sg.db.com/*
db-sg.db.com/gen/login/index_4.cfm*
direct.capitecbank.co.za/*
direct.capitecbank.co.za/ibank*
direct.mcbgroup-ebanking.com/*
direct.mcbgroup-ebanking.com/*
direct.mcbgroup-ebanking.com/cmblogin/corporate_AuthenticateUserLocalEPF.html*
direct.mcbgroup-ebanking.com/mcblogin/corporate_AuthenticateUserLocalEPF.html*
drob.santanderbank.com/*
drob.santanderbank.com/cscobgss/Satellite*
e-access.compassbank.com/*
e-access.compassbank.com/bbw/cmserver/welcome/default/verify.cfm*
eadibcorp.adib.ae/*
eadibcorp.adib.ae/cb/servlet/cb/jsp-ns/login.jsp*
ebaer.juliusbaer.com/*
ebaer.juliusbaer.com/*
ebanking2.danskebank.co.uk/*
ebanking2.danskebank.co.uk/pub/logon/logon.aspx*
ebanking-aut.ubs.com/*
ebanking-aut.ubs.com/*
ebanking-aut.ubs.com/*
ebanking-aut.ubs.com/epexa*
ebanking-aut.ubs.com/estmta*
ebanking-aut.ubs.com/fim*
ebanking-au.ubs.com/*
ebanking-au.ubs.com/ebanking*
ebanking-bel.ubs.com/*
ebanking-bel.ubs.com/*
ebanking-bel.ubs.com/*
ebanking-bel.ubs.com/epexb*
ebanking-bel.ubs.com/estmtb*
ebanking-bel.ubs.com/fim*
ebanking-bhs2.ubs.com/*
ebanking-bhs2.ubs.com/epex*
ebanking-can.ubs.com/*
ebanking-can.ubs.com/*
ebanking-can.ubs.com/epex*
ebanking-can.ubs.com/estmtc*
ebanking-ca.ubs.com/*
ebanking-ca.ubs.com/*
ebanking-ca.ubs.com/*
ebanking-ca.ubs.com/*
ebanking-ca.ubs.com/estmtc/action/login*
ebanking-ca.ubs.com/gepc/MainAction*
ebanking-ca.ubs.com/safeloginc/Login*
ebanking-ca.ubs.com/safeloginc/Login*
ebanking-ch2.ubs.com/*
ebanking-ch2.ubs.com/*
ebanking-ch2.ubs.com/workbench/Index.do*
ebanking-ch2.ubs.com/workbench/Index.do*
ebanking-ch.ubs.com/*
ebanking-ch.ubs.com/workbench/Index.do*
ebanking-de1.ubs.com/*
ebanking-de1.ubs.com/workbench/Index.do*
ebanking-es.ubs.com/*
ebanking-es.ubs.com/*
ebanking-fr.ubs.com/*
ebanking-fr.ubs.com/enquiries/*
ebanking-hksg.ubs.com/*
ebanking-hksg.ubs.com/*
ebanking-it.ubs.com/*
ebanking-it.ubs.com/*
ebanking-lux.ubs.com/*
ebanking-lux.ubs.com/*
ebanking-lux.ubs.com/*
ebanking-lux.ubs.com/epex*
ebanking-lux.ubs.com/estmt*
ebanking-lux.ubs.com/fim*
ebanking-mc.ubs.com/*
ebanking-mc.ubs.com/*
ebanking-nld.ubs.com/*
ebanking-nld.ubs.com/estmtn*
ebanking.schwaebische-bank.de/*
ebanking.schwaebische-bank.de/loginStart.do*
ebanking.societegenerale.al/*
ebanking.societegenerale.al/webbankALB/loginCer.jsp*
ebanking-uk.ubs.com/*
ebanking-uk.ubs.com/*
ebank.turkishbank.co.uk/*
ebank.turkishbank.co.uk/Default2.aspx*
e-bank.unicreditbank.si/*
e-bank.unicreditbank.si/webbankBACX*
entreprises.societegenerale.fr/*
entreprises.societegenerale.fr/*
entreprises.societegenerale.fr/*
entreprises.societegenerale.fr/*
entreprises.societegenerale.fr/associations-connexion.html*
entreprises.societegenerale.fr/index.html*
esavings.shawbrook.co.uk/*
esavings.shawbrook.co.uk/BankFast/Shawbrook*
extra.unicreditbank.hu/*
extra.unicreditbank.hu/*
extra.unicreditbank.hu/*
extra.unicreditbank.hu/*
extra.unicreditbank.hu/eibpublic_SP/login.de.html*
extra.unicreditbank.hu/eibpublic_SP/login.en.html*
extra.unicreditbank.hu/eibpublic_SP/login.hu.html*
extra.unicreditbank.hu/eib_SP/loginpage.hu.html*
fareastnationalbank.ebanking-services.com/*
fareastnationalbank.ebanking-services.com/EamWeb/account/login.aspx*
fastbanking.bancpost.ro/*
fastbanking.bancpost.ro/iBankWeb/login.jsp*
fastpay.asbbank.co.nz/*
fastpay.asbbank.co.nz/Account/LogOn*
fdonline.co-operativebank.co.uk/*
fdonline.co-operativebank.co.uk/corp/BANKAWAY*
financepilot-pe.mlp.de/*
financepilot-pe.mlp.de/p13pepe/entry*
finanzportal.fiducia.de/*
finanzportal.fiducia.de/*
finanzportal.fiducia.de/p01pebe/entry*
finanzportal.fiducia.de/p13pepe/entry*
fx.regions.com/*
fx.regions.com/esn01/servlet/RSASingleSignOn*
globalpay.westernunion.com/*
globalpay.westernunion.com/GlobalPay/Login.aspx*
group.unicreditbanking.net/*
group.unicreditbanking.net/*
hbciweb.olb.de/*
hbciweb.olb.de/financebrowser5*
home1.ybonline.co.uk/*
home1.ybonline.co.uk/raluV8/reglm-web/login.ctl*
home2.cybusinessonline.co.uk/*
home2.cybusinessonline.co.uk/lmgruV8/ceblm-web/login.ctl*
homebank.tsbbank.co.nz/*
homebank.tsbbank.co.nz/online*
ht.businessonlinepayroll.com/*
ht.businessonlinepayroll.com/SPF/login/ee_auth.aspx*
ib.absa.co.za/*
ib.absa.co.za/absa-online/login.jsp*
ibank1.bib.barclays.com/*
ibank1.bib.barclays.com/logon*
ibank.gtbankuk.com/*
ibank.gtbankuk.com/Gaps_UK/Default.aspx*
ibank.reliancebankltd.com/*
ibank.reliancebankltd.com/logon.aspx*
ibank.sbs.net.nz/*
ibank.sbs.net.nz/ui/inetbankindex.aspx*
ibank.standardchartered.com.sg/*
ibank.standardchartered.com.sg/nfs/login.htm*
ibank.theaccessbankukltd.co.uk/*
ibank.theaccessbankukltd.co.uk/entry/CorpLoginLang.html*
ibank.zenith-bank.co.uk/*
ibank.zenith-bank.co.uk/internetbanking/index.jsp*
ib.banksyd.com.au/*
ib.banksyd.com.au/*
ibb.firsttrustbank1.co.uk/*
ibb.firsttrustbank1.co.uk/ibb/controller*
ib.btrl.ro/*
ib.btrl.ro/BT24/bfo/channel/web/loginframe.jsp*
ibs.bankwest.com.au/*
ibs.bankwest.com.au/BWLogin/bib.aspx*
ib.tmbank.com.au/*
ib.tmbank.com.au/ib/signon/Login.aspx*
ibusinessbanking.aib.ie/*
ibusinessbanking.aib.ie/ibb/controller*
ideal.dbs.com/*
ideal.dbs.com/loginSubscriber/login/pin.jsp*
inba.lukb.ch/*
inba.lukb.ch/lukbLogin/*
inetbnkp.adelaidebank.com.au/*
inetbnkp.adelaidebank.com.au/OnlineBanking/AdBank*
infinity.icicibank.co.uk/*
infinity.icicibank.co.uk/UKRET/BANKAWAY*
internet-banking.dbs.com.sg/*
internet-banking.dbs.com.sg/IB/Welcome*
internetbanking.firstcaribbeanbank.com/*
internetbanking.firstcaribbeanbank.com/index.jsp*
internetbanking.suncorpbank.com.au/*
internetbanking.suncorpbank.com.au/*
internet.ocbc.com/*
internet.ocbc.com/internet-banking*
invest.etrade.com.au/*
invest.etrade.com.au/Home.aspx*
jpmcsso.jpmorgan.com/*
jpmcsso.jpmorgan.com/*
jpmcsso.jpmorgan.com/sso/action/federateLogin*
jpmcsso.jpmorgan.com/sso/action/login*
jpmcsso-uk.jpmorgan.com/*
jpmcsso-uk.jpmorgan.com/sso/action/federateLogin*
ktt.key.com/*
ktt.key.com/ktt/cmd/logon*
kunden.commerzbank.de/*
kunden.commerzbank.de/lp/login*
kunden-mkb-bank.de/*
kunden-mkb-bank.de/*
leumionline.bankleumi.co.uk/*
leumionline.bankleumi.co.uk/my.policy*
lloydslink.online.lloydsbank.com/*
lloydslink.online.lloydsbank.com/Logon/Logon.jsp*
localbitcoins.com/*
localbitcoins.com/accounts/login*
login.24banking.ro/*
login.24banking.ro/casserver/login*
login.isso.db.com/*
login.isso.db.com/*
login.isso.db.com/websso/sso_custom_multi_auth_flex_Logon.sso*
login.isso.db.com/websso/sso_multi_auth_Logon.sso*
login.salesforce.com/*
login.salesforce.com/*
login.smartbusiness.ae/*
login.smartbusiness.ae/bo-login.jsp*
mcbdirect.mcb-bank.com/*
mcbdirect.mcb-bank.com/business/online*
mcbdirect.mcbbonaire.com/*
mcbdirect.mcbbonaire.com/business/online*
mdcommercial.jpmorgan.com/*
mdcommercial.jpmorgan.com/*
meine.deutsche-bank.de/*
meine.deutsche-bank.de/trxm/db*
my.banklenz.de/*
my.banklenz.de/web/guest/login*
my.hypovereinsbank.de/*
my.hypovereinsbank.de/*
my.hypovereinsbank.de/login*
my.hypovereinsbank.de/login*
my.sjpbank.co.uk/*
my.sjpbank.co.uk/*
my.sjpbank.co.uk/Security/Auth/Logon*
my.sjpbank.co.uk/Security/Auth/Logon*
my.statestreet.com/*
my.statestreet.com/*
nabconnect*.nab.com.au/*
nabconnect*.nab.com.au/auth/nabclogin/login.do*
nebasilicon.fdecs.com/*
nebasilicon.fdecs.com/eCustService/*
netbanking.mashreqbank.com/*
netbanking.mashreqbank.com/B001/SMELogin.jsp*
netbanking.ubluk.com/*
netbanking.ubluk.com/Login/Index*
net.crediteurope.ro/*
net.crediteurope.ro/ibank-cln/do/login/prompt*
netteller2.tsw.com.au/*
netteller2.tsw.com.au/delphi/ntv451.asp*
netteller3.pnbank.com.au/*
netteller3.pnbank.com.au/InternetBanking/Login.aspx*
online.adambank.com/*
online.adambank.com/eBankingAdamLogin/login*
onlinebanking.bankcoop.ch/*
onlinebanking.bankcoop.ch/*
online.bankmecu.com.au/*
online.bankmecu.com.au/daib/logon/cu3140/logon.asp*
online.bankofcyprus.co.uk/*
online.bankofcyprus.co.uk/netteller/login.faces*
online.bankofscotland.co.uk/*
online.bankofscotland.co.uk/personal/logon/login.jsp*
online.bulbank.bg/*
online.bulbank.bg/page/default.aspx*
online-business.bankofscotland.co.uk/*
online-business.bankofscotland.co.uk/business/logon/login.jsp*
onlinebusiness.lloydsbank.co.uk/*
onlinebusiness.lloydsbank.co.uk/business/logon/login.jsp*
onlinebusinessplus.vancity.com/*
onlinebusinessplus.vancity.com/business/default.jsp*
online.citi.eu/*
online.citi.eu/GBIPB/JSO/signon/DisplayUsernameSignon.do*
online.corp.westpac.com.au/*
online.corp.westpac.com.au*
online.coutts.com/*
online.coutts.com/eBankingCouttsLogin/login*
online.dib.ae/*
online.dib.ae/webapplication.ui/localoperations/login/loginpage.aspx*
online.duncanlawrie.com/*
online.duncanlawrie.com/InternetBanking/faces/mdi/login.jsp*
online.ebs.ie/*
online.ebs.ie/internet/login/index.jsp*
online.hbs.net.au/*
online.hbs.net.au/hbsv47/ntv471.asp*
online.hoaresbank.co.uk/*
online.hoaresbank.co.uk/fi11512/bb/logon*
online.kbc.ie/*
online.kbc.ie/kbc-online/onlinebanking/login*
online.lloydsbank.co.uk/*
online.lloydsbank.co.uk/personal/logon/login.jsp*
online.multiport.com.au/*
online.multiport.com.au/*
online.nbad.com/*
online.nbad.com/iportalweb/iportal/jsps/orbilogin.jsp*
online.privatebanking.societegenerale.be/*
online.privatebanking.societegenerale.be/*
online.privatebanking.societegenerale.be/sg/login_fr.html*
online.privatebanking.societegenerale.be/sg/login_nl.html*
online-private.unicredit.it/*
online-private.unicredit.it/login.htm*
online-retail.unicredit.it/*
online-retail.unicredit.it/login.htm*
onlineservices.ubs.com/*
onlineservices.ubs.com/olsauth/ex/pbl/ubso/dl*
online-smallbusiness.unicredit.it/*
online-smallbusiness.unicredit.it/login.htm*
online.unicreditcorporate.it/*
online.unicreditcorporate.it/login.htm*
online.ybs.co.uk/*
online.ybs.co.uk/public/authentication/login1.do*
particuliers.societegenerale.fr/*
particuliers.societegenerale.fr/*
personal.co-operativebank.co.uk/*
personal.co-operativebank.co.uk/CBIBSWeb/start.do*
pfo.us.hsbc.com/*
pfo.us.hsbc.com*
portal.northonline.com.au/*
portal.northonline.com.au/WealthNET.PortalClient*
private.bankofsingapore.com/*
private.bankofsingapore.com/Login/Login*
privatebank-us.ubs.com/*
privatebank-us.ubs.com/*
professionnels.societegenerale.fr/*
professionnels.societegenerale.fr/*
professionnels.societegenerale.fr/association_connexion.html*
professionnels.societegenerale.fr/index.html*
pro.skb.net/*
pro.skb.net/*
quotes-global1.ubs.com/*
quotes-global1.ubs.com/go/*
rakbankonline.ae/*
rakbankonline.ae/corp/BANKAWAY*
retail.santander.co.uk/*
retail.santander.co.uk/LOGSUK_NS_ENS/BtoChannelDriver.ssobto*
ro.unicreditbanking.net/*
ro.unicreditbanking.net/disp*
s2b.standardchartered.com/*
s2b.standardchartered.com/ssoapp/login.jsp*
safello.com/*
safello.com/login*
santander.hpdsc.com/*
santander.hpdsc.com/main*
secure1.rabodirect.co.nz/*
secure1.rabodirect.co.nz/exp/policyenforcer/pages/loginB2CDGPEN.jsf*
secure2.alphabank.ro/*
secure2.alphabank.ro/corporate/CorpOTPLoginLangRom.jsp*
secure.aldermorebusinesssavings.co.uk/*
secure.aldermorebusinesssavings.co.uk/corporate*
secure.ampbanking.com/*
secure.ampbanking.com/au/Logon*
secure.anz.co.nz/*
secure.anz.co.nz/IBCS/service/login*
secure.coinjar.com/*
secure.coinjar.com/users/sign_in*
secure.defencebank.com.au/*
secure.defencebank.com.au/daib/logon/cu3205/logon.asp*
secure.handelsbanken.com/*
secure.handelsbanken.com/bb/glss/servlet/prelogon*
secure.heartland.co.nz/*
secure.heartland.co.nz/IB/index.zul*
secure.internetbanking.ro/*
secure.internetbanking.ro/IBK_SMS/Login/LoginFirstStep.aspx*
secure.macquarie.com.au/*
secure.macquarie.com.au/sepas/serve*
secure.membersaccounts.com/*
secure.membersaccounts.com/SELFSERVICE/login.aspx*
securentrycorp.amegybank.com/*
securentrycorp.amegybank.com*
securentrycorp.calbanktrust.com/*
securentrycorp.calbanktrust.com*
securentrycorp.nsbank.com/*
securentrycorp.nsbank.com*
securentrycorp.zionsbank.com/*
securentrycorp.zionsbank.com/*
secure.tddirectinvesting.co.uk/*
secure.tddirectinvesting.co.uk/webbroker2/login.jsp*
secure.unicreditbank.lu/*
secure.unicreditbank.lu/*
sg.bibplus.uobgroup.com/*
sg.bibplus.uobgroup.com/BIB/public*
sikanet.sg-ssb.com.gh/*
sikanet.sg-ssb.com.gh/*
sikanet.sg-ssb.com.gh/priv/en/dciweb.htm*
sikanet.sg-ssb.com.gh/priv/en/dciweb.htm*
singlepoint.usbank.com/*
singlepoint.usbank.com/cs70_banking/logon/sbuser*
si.unicreditbanking.net/*
si.unicreditbanking.net/disp*
sogecashnet.sga.dz/*
sogecashnet.sga.dz/smartoffice*
sogecashnet.societegenerale.cg/*
sogecashnet.societegenerale.cg/*
sogecashnet.societegenerale.cg/smartoffice/GB*
sogecashnet.societegenerale.cg/smartoffice/index.htm*
sogeonline.societegenerale.cn/*
sogeonline.societegenerale.cn/eweb/prelogin.do*
tb.raiffeisendirect.ch/*
tb.raiffeisendirect.ch/*
tdetreasury.tdbank.com/*
tdetreasury.tdbank.com/s1gcb/logon/sbuser*
top.capitalonebank.com/*
top.capitalonebank.com/*
top.capitalonebank.com/cashplus/*
top.capitalonebank.com/pub/html/login.html*
trz.tranzact.org/*
trz.tranzact.org/LogonOTP.aspx*
unified-access.societegenerale.com/*
unified-access.societegenerale.com/portal/site/SogecashWeb*
uniservices2.uobgroup.com/*
uniservices2.uobgroup.com/ELO/login.jsp*
usgateway.rbs.com/*
usgateway.rbs.com/wps/portal/cb/applications*
velocity.ocbc.com/*
velocity.ocbc.com/portal.view*
wealth.goldman.com/*
wealth.goldman.com/login/login_a.cgi*
webcmpr.bancopopular.com/*
webcmpr.bancopopular.com/K1*
wellsoffice.wellsfargo.com/*
wellsoffice.wellsfargo.com/ceoportal/signon/index.jsp*
wibdirect.wib-bank.net/*
wibdirect.wib-bank.net/business/online*
www1.firstdirect.com/*
www1.firstdirect.com/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDgzAfSycDUy8LAzNDbz8vbzMDKADKR5rFO7s7epiY-wD5YZ6uBp4mTiYGpr5uhgaexmDdFibeBn7enkEuBs4ejiYeHkGGMN0FuaGKAPRSfDc!*
www1.rbcbankusa.com/*
www1.rbcbankusa.com/cgi-bin/rbaccess/rbunxcgi*
www22.bmo.com/*
www22.bmo.com/ctpauth/CTPEAILogin/CustUserPasswordAuthServlet*
www2.secure.hsbcnet.com/*
www2.secure.hsbcnet.com/uims/portal/IDV_CAM10_AUTHENTICATION*
www.365online.com/*
www.365online.com/online365/spring/authentication*
www6.rbc.com/*
www6.rbc.com/webapp/ukv0/signin/logon.xhtml*
www.anz.com/*
www.anz.com/INETBANK/bankmain.asp*
www.anztransactive.anz.com/*
www.anztransactive.anz.com/*
www.arabi-online.net/*
www.arabi-online.net/efs/servlet/efs/jsp-ns/login.jsp*
www.asb.co.nz/*
www.asb.co.nz/Business-Banking*
www.asbolb.com/*
www.asbolb.com/servlet/ASB.ASBServlet*
www.asl.com/*
www.asl.com/asl/login/entryFrame.jsp*
www.bankdirect.co.nz/*
www.bankdirect.co.nz*
www.banking.axa.de/*
www.banking.axa.de/OnlineBankingWebfrontend/banking/common/login.xhtml;jsessionid=F05F46A7333D65031BD6C9B43C062C31*
www.bankline.natwest.com/*
www.bankline.natwest.com/CWSLogon/logon.do*
www.bankline.rbs.com/*
www.bankline.rbs.com/CWSLogon/logon.do*
www.bankline.ulsterbank.ie/*
www.bankline.ulsterbank.ie/CWSLogon/logon.do*
www.barclayswealth.com/*
www.barclayswealth.com/*
www.barclayswealth.com/login/action/logon/unauthenticated/corporate/loginSigningGemplus*
www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginDetailsRouting*
www.bcv.ch/*
www.bcv.ch/*
www.bcv.ch/*
www.bcv.ch/*
www.bcv.ch/bcvd-login/authenticateAction.do*
www.bcv.ch/de*
www.bcv.ch/en*
www.bcv.ch/fr*
www.bendigobank.com.au/*
www.bendigobank.com.au/banking/BBLIBanking*
www.bitstamp.net/*
www.bitstamp.net/account/login*
www.bnz.co.nz/*
www.bnz.co.nz/ib4b/app/login*
www.boi-bol.com/*
www.boi-bol.com/newHome.jsp*
www.brdoffice.ro/*
www.brdoffice.ro/*
www.brdoffice.ro/*
www.brdoffice.ro/smartoffice/_mcologon*
www.brdoffice.ro/smartoffice/_mcologon*
www.brdoffice.ro/smartoffice/_mcologon*
www.business.hsbc.co.uk/*
www.business.hsbc.co.uk/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDgzAfSycDUy8LAzNDbz8vbzMDKADKR2LKuyHkgbotDB1dDZyDDTwMzM0sDTy93B1dnXz8DN0tTCC6nd0dPUzMfYCqwzxdDTxNnEwMTH3dDA08jQnoLsgNDQUAO-nOhw!!*
www.bv-activebanking.de/*
www.bv-activebanking.de/*
www.bv-activebanking.de/*
www.bv-activebanking.de/dbm/loginFormAction.do*
www.bv-activebanking.de/neelmeyer/loginFormAction.do*
www.bv-activebanking.de/trinkaus/loginFormAction.do*
www.caterallenonline.co.uk/*
www.caterallenonline.co.uk/*
www.ceconline.ro/*
www.ceconline.ro/smartoffice/logon.htm*
www.chase.com/*
www.chase.com/commercial-bank/chase-commercial-online*
www.citibank.com.au/*
www.citibank.com.au/AUGCB/JSO/signon/DisplayUsernameSignon.do*
www.citibank.com.sg/*
www.citibank.com.sg/SGGCB/JSO/signon/DisplayUsernameSignon.do*
www.citibusiness.citibank.com.sg/*
www.citibusiness.citibank.com.sg/SGCBZ/JSO/signon/DisplayUsernameSignon.do*
www.cmb-home.com/*
www.cmb-home.com/online/site002index.itm*
www.coinbase.com/*
www.coinbase.com/signin*
www.commercial.hsbc.com.hk/*
www.commercial.hsbc.com.hk/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDd-NQv1BDg2AXA1-PEE9zPwtDAwgAykeaxTu7O3qYmPsA-WGergaeJk4mBqa-boYGnsbYdPsidBfkhioCAMGAADI!*
www.corpnet.lu/*
www.corpnet.lu/corpnet/loginCorp.jsp*
www.corporate-clients.commerzbank.com/*
www.dab-bank.de/*
www.dab-bank.de/Mein-Konto-Depot/Login*
www.dbsvonline.com/*
www.dbsvonline.com/english/index.asp*
www.deutschebank-dbdirect.com/*
www.deutschebank-dbdirect.com/cas/login*
www.ebanking.hsbc.co.nz/*
www.ebanking.hsbc.co.nz/1/2/!ut/p/c5/jZBdC4IwGEZ_0vtuI6VLXTitmeGa6G5kiIigMyKK_n3rJrrpg-fynHPzgAE_Z6_jYC_j4uwENZigzYMQOd0yFLwIkJbZmsu4JCJhnjefecn-qkklokxTLEjquUxCKsUBxRF_1Kp3rVawT5e5hwZM-CYr8ZTzjVzFyDhn0Ez9YLv7d0-Rl6cdVG45z_6D06zr205GD_hDJm4!/dl3/d3/L0lJSklna21BL0lKakFBTXlBQkVSQ0pBISEvNEZHZ3NvMFZ2emE5SUFnIS83X002NzBDMkozMEdTRzYwMlJNREw1QjAzQ0MzL0FHVnNUNDc3MjAwMDQ!*
www.fcsolb.com/*
www.fcsolb.com/cb/pages/jsp-ns/login.jsp*
www.fidunet.lu/*
www.fidunet.lu/fidunet/loginFidu.jsp*
www.firstmerit.com/*
www.firstmerit.com/commercial/index.html*
www.firstmeritib.com/*
www.firstmeritib.com/ec/DefaultCorp.aspx*
www.flexipurchase.com/*
www.flexipurchase.com/secure/welcome.asp*
www.fnb.co.za/*
www.fnb.co.za/*
www.frostcashmanager.com/*
www.frostcashmanager.com/CASHplus*
www.gecapitalbank.com/*
www.gecapitalbank.com/gecb/app/login*
www.gemyaccounts.com/*
www.gemyaccounts.com/myaccounts/Index.html*
www.goldman.com/*
www.goldman.com/login/login_a.cgi*
www.gtb.unicredit.eu/*
www.gtb.unicredit.eu/login*
www.halifax-online.co.uk/*
www.halifax-online.co.uk/personal/logon/login.jsp*
www.hsbc.com.au/*
www.hsbc.com.au/1/2/HUB_IDV2/IDV_EPP*
www.hsbc.com.sg/*
www.hsbc.com.sg/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDf6NAZ8tQU3c3A0dDV5MAf2MTAwjQL8h2VAQAdKy3eg!!/*
www.hsbc.co.uk/*
www.hsbc.co.uk/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDgzAfSycDUy8LAzNDbz8vbzMDKADKR5rFO7s7epiY-wD5YZ6uBp4mTiYGpr5uhgaexmDdFibeBn7enkEuBs4ejiYeRiHGMN1-Hvm5qfoFuRHlABOr0sE!/*
www.hvbrsce.com/*
www.hvbrsce.com/ebanking/Athens/Pages/ElectronicBanking.htm*
www.ib.boq.com.au/*
www.ib.boq.com.au/boqbl*
www.ib.kiwibank.co.nz/*
www.ib.kiwibank.co.nz/*
www.ingonline.com/*
www.ingonline.com/ro/!UPR.Dispatcher*
www.internationalpayments.co.uk/*
www.internationalpayments.co.uk/*
www.investbank.ae/*
www.investbank.ae/ibank/loginAction.do*
www.iombankibanking.com/*
www.iombankibanking.com/eai/IPB_EAI_Web/eai*
www.kbinternetbanking.com/*
www.kbinternetbanking.com/*
www.mcbb-home.com/*
www.mcbb-home.com/online/site003index.itm*
www.mcb-home.com/*
www.mcb-home.com/online/site001index.itm*
www.mercantilcbonline.com/*
www.mercantilcbonline.com/*
www.mercantilcbonline.com/secure/banking/individualLogon*
www.mercantilcbonline.com/secure/banking/logon*
www.mkbag.de/*
www.mkbag.de/ptlweb/WebPortal*
www.my.commbank.com.au/*
www.my.commbank.com.au/netbank/Logon/Logon.aspx*
www*.my.commbiz.commbank.com.au/*
www*.my.commbiz.commbank.com.au/Logon/UserMaintenance/Login.aspx
www.natwestibanking.com/*
www.natwestibanking.com/eai/IPB_EAI_Web/customerNumber.do*
www.noorinternetbanking.com/*
www.noorinternetbanking.com/CWCLIENT/loginClient.action*
www.nwolb.com/*
www.nwolb.com/default.aspx*
www.obsgnet.com.mk/*
www.obsgnet.com.mk/Retail/LoginModule/LoginToken.aspx*
www.onlinebanking.iombank.com/*
www.onlinebanking.iombank.com/default.aspx*
www.onlinebanking.natwestoffshore.com/*
www.onlinebanking.natwestoffshore.com/default.aspx*
www.onlinesbiglobal.com/*
www.onlinesbiglobal.com/*
www.onlinesbiglobal.com/64SG/BANKAWAY*
www.onlinesbiglobal.com/64SG/BANKAWAY*
www.open24.ie/*
www.open24.ie/online/login.aspx*
www.postfinance.ch/*
www.postfinance.ch/ap/ba/fp/html/e-finance/home*
www.privatebanking.societegenerale.com/*
www.privatebanking.societegenerale.com/*
www.privatebanking.societegenerale.com/en/banking/luxembourg*
www.privatebanking.societegenerale.com/en/banking/monaco*
www.raiffeisenonline.ro/*
www.raiffeisenonline.ro/eBankingWeb/login*
www.rbsdigital.com/*
www.rbsdigital.com/login.aspx*
www.rbsidigital.com/*
www.rbsidigital.com/default.aspx*
www.rbsiibanking.com/*
www.rbsiibanking.com/ipb/IPB_Client_Web/Start.do*
www.scotiaconnect.scotiabank.com/*
www.scotiaconnect.scotiabank.com/sco-tp/pki/AuthenticateUserRoamingEPF.bns*
wwwsec.ebanking.zugerkb.ch/*
wwwsec.ebanking.zugerkb.ch/authen/login*
wwwsec.valiant.ch/*
wwwsec.valiant.ch/authen/login*
www.sgcb.nc/*
www.sgcb.nc/*
www.sgcb.nc/part/en/dciweb.htm*
www.sgcb.nc/part/fr/dciweb.htm*
www.signatureny.web-access.com/*
www.signatureny.web-access.com/signat/cgi-bin/login.cgi*
www.sogecashnet.ma/*
www.sogecashnet.ma/smartoffice/index.htm*
www.sogehomebank.com/*
www.sogehomebank.com/Retail/login.aspx*
www.standardlife.co.uk/*
www.standardlife.co.uk/1/site/uk/login*
www.superchoice.com.au/*
www.superchoice.com.au/amp*
www.superorganised.com.au/*
www.superorganised.com.au/dashboard/login*
www.svbconnect.com/*
www.svbconnect.com/auth*
www.tranzact.org/*
www.tranzact.org/*
www.treasury.pncbank.com/*
www.treasury.pncbank.com/idp/esec/login.ht*
www.ubs.com/*
www.ubs.com/connect*
www.uibanking-net.com/*
www.uibanking-net.com/*
www.uibanking-net.com/smartoffice/fr/connexion.html*
www.uibanking-net.com/smartoffice/GB/connexion.html*
www.ulsterbankanytimebanking.ie/*
www.ulsterbankanytimebanking.ie/default.aspx*
www.unicreditbank.ba/*
www.unicreditbank.ba/eba/BHgradjani*
www.unicreditbank.cz/*
www.unicreditbank.cz/*
www.unicreditbank.cz/web/redirect.php*
www.unicreditbank.cz/web/redirect.php*
www.unicreditbank.sk/*
www.unicreditbank.sk/i-banking-sk-https.html*
www.unity-online.co.uk/*
www.unity-online.co.uk/*
www.us.hsbcprivatebank.com/*
www.us.hsbcprivatebank.com/1/2/PBRSINTEGRATION/gpbus*
www.vancity.com/*
www.vancity.com/BusinessBanking/OnlineBanking/MyAccounts*
www.wib-home.com/*
www.wib-home.com/online/site004index.itm*
www.youinvest.co.uk/*
www.youinvest.co.uk/LogIn/username*
www.zaba.hr/*
www.zaba.hr/ebank/gradjani/Prijava*

~~

La fiche Trojan.Dyre - Trojan.Staser qui explique comment désinfecter son ordinateur et supprimer cette famille de malware.

[Malekal_morte]

Symantec annonce une baisse de l'activité du malware Dyreza

Symantec_Dyre.png

Les campagnes d'emails malicieux poussant le Trojan Downloader Upatre, comme évoqué dans le message précédent, ont subitement chuté depuis Novembre 2015.

Symantec_Dyre_Upatre.png

Le malware pouvait aller jusqu'à 250 000 infections par mois.

Pour le moment pas d'explication.

Dr Web donne aussi quelques informations en anglais : http://news.drweb.com/show/?i=9829&lng=en&c=5
notamment sur l'infrastructure qui semble compliquée.
Les serveurs semblent utiliser du Tor, proxy et des VPN.

According to Doctor Web specialists, Trojan.Dyre’s infrastructure is rather unique because it is much more complicated in comparison with other notorious financial malware programs. In most cases, information from compromised machines was sent to the server where a bot control panel was located. However, Trojan.Dyre’s developers implemented various technologies, which proved that the gang had considerable financial and human resources. At that, servers that processed information received from bots were written in .Net, and botnets administrator panels—using the Kohana php framework. To store and process data arrays coming from any spot of the Earth, they used the postgres and mysql bases, and sphinx, a full text search server. All incoming information was assigned to special filters so that cybercriminals could quickly find any information they were interested in—for instance, logins, passwords, bank card numbers, users’ personal data, and so on. To complicate the detection of the servers, Tor servers and proxy servers associated by implementing openvpn were used. A key feature of Trojan.Dyre’s attack was that it located first proxy layer on hacked routers whose routing table was modified. Wi-fi routers were hacked by brute-forcing passwords since users often do not change default settings of their routers, and some victims do not even think that routers can be somehow used to infect their machines.

[Malekal_morte]

La chute observée depuis Novembre par Dyre/Dyreza s'explique par une opération des autorités et services secrets Russes : Report: Dyre Crackdown in Moscow.

Tweet de Kaspersky Dyrez/Dyreza : Tango Down

Dyre_Dyreza_Tango_Down_Kaspersky.png

Apparemment l'opération a ralenti mais pas stoppé les campagnes.