Skip to main content

Trojan-Spy:W32/Shiotob

Classification

Category:Malware
Type:Trojan-Spy
Platform:W32
Aliases:

Bebloh, URLZone

Summary

Shiotob, also known as URLZone or Bebloh, is a banking trojan which sends sensitive data to a command and control (C&C) server and receives commands to perform malicious operations.

Removal

The F-Secure security product will automatically remove the file.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Infection Vector

Commonly downloaded via malicious document that arrives as an attachment in a spam email.

Behavior

Shiotob injects malicious code into explorer.exe or iexplorer.exe and executes from there.

Stealth capability

The sample's execution will be terminated if the following conditions are met:

  • Running in debugger by checking the "Isdebuggerpresent" API
  • Running in VMware by checking the "VMWARE" string
  • The sample name is "SAMPLE", "VIRUS" or "SANDBOX"
  • If the processor of the computer is 'Xeon'
  • If the sample is run with command line and the arguments are either -aurnato or -udpid. If yes, it will then set a flag.

Dropped files

Shiotob creates a file in the location "C:\Program Files (x86)\Windows NT\<random>.exe"

(random filename based on these keywords: win, video, def, mem, dns, setup, user, logon, hlp, mixer, pack, mon, srv, exec, and play)

Registry changes

  • HKEY_LOCAL_MACHINE\SOFTWARE\<random name>:

    Created Mutex

    • Global\Uz[A-Za-z0-9]{8}

    Check proxy

    Checks the proxy setting by searching \Mozilla\Firefox\Profiles\prefs.js

    Network Activities

    • Checking internet connection by connecting to www[.]google[.]com
    • Connects to C2 server: olkerona[.]com/auth
    • C2 format:

      Analysis based on sample: 0d8fd93b0b59ab2c3b41e2eadb1d9ea6f4dce9ea

      More Support

      Community

      Ask questions in our Community.

      User guides

      Check the user guide for instructions.

      Contact Support

      Chat with with or call an agent.

      Submit a Sample

      Submit a file or URL for analysis.