Dyre: A Worldwide Threat to Internet Banking

In 2014, more than 1000 international banking and management systems worldwide were attacked by cybercriminals flinging Dyre malware and its variants. AhnLab observed that the mode of operation in distribution of Dyre involves sending the malware in packaged files in .zip or .rar to infiltrate organizations via spammed emails. What is more dreadful is that this malware, being intelligent in nature, is displaying the ability to successfully evade analysis executed by sandboxing. To evade analysis, Dyre builds it’s own intelligence by checking fo​r the number of processor cores the machine has. If the machine has only one processor core, it will terminate. Today, most machines are running multi-processor cores; this enables the Dyre technique of evading sandboxing analysis.

Since early 2015, Dyre has been detected to be targeting banks in South Korea and this resulted in intensified pressure in the Korean banking institutions to mitigate from Dyre. Security professionals conceded that Dyre is a serious threat that is exposed to businesses and the individual end-user. Dyre intercepts Internet banking information hijacked by another malware, Upatre. Dyre is primarily disseminated as an e-mail attachment. If a victim executes the attachment, they are directed to a fake website where an attempt to extract personal information occurs. Attacks from Dyre are anticipated to increase because it affects most common web browsers, like Internet Explorer (IE), Chrome, and Firefox. In this Threat Analysis, we examine the detailed information about Dyre’s structure, mechanism, and function and how they pose a threat to banks.

When Dyre is delivered to a victim's system through an e-mail attachment, the victim’s PC is infected. The code is activated the next time the victim logs into their internet banking service. If the internet banking service's URL is contained in the malware’s list of bank URLs, Dyre hijacks bank account information and executes malicious activities, such as keylogging. The malicious activities that Dyre performs are listed in the following table.

Dyre Structure and Process Steps
[Figure 1] illustrates the structure of Dyre and shows process of Dyre using a file downloaded by Upatre. The code is comprised of an injector and injected (system processes and the web browser).  

[Figure 1] Malware process

1. Injector
When Dyre is first executed, it decodes a PE file in the system resources area and substitutes the memory’s section image. Then, Dyre decodes another PE file in the system resources area and injects it into a currently running system process.

The PE file that has been injected into the system process, functions as a thread and attempts to connect to the C&C server. Commands are received from the C&C server and the malicious function typically attempts to patch the browser code with the intention of stealing online banking information. 

[Figure 2] Decoding Routine

To bypass detection by a virtual machine (VM), Dyre checks for the information contained in the table below.

2. System Process - Injected DLL
The main function of injected DLL is to initiate the following actions:
① Creating and checking Mutex: Creates an innate mutex and checks that the malware is active
② Checking the operating system (OS) version
③ Configuring Read/Write log (setting) files
Windows 8.1 is included in the range of operating systems that the injected DLL checks. The operating systems that are checked are listed in Figure 3.

 
[Figure 3] OS versions targeted by Dyre

The injected DLL checks for an existing Internet connection with the following three addresses and servers listed in the table below. If the connection fails, a connection to the C&C server is not established.

Once a successful connection is established over the internet, it decodes the encoded data from within the file and receives an IP address from the C&C server as shown in [Figure 4]. When Dyre communicates with the C&C server, it uses POST and GET methods as specified in the attack commands.
  

 [Figure 4] C&C addresses inside Dyre

The C&C server attempts to gain remote access by using the RDP function to add or edit registries. 

3. Browser - Injected DLL
Dyre can exploit all of the major web browsers including IE, Chrome, and Firefox to lure victims to fake sites. This page will focus on IE and the example in the following diagram demonstrates an attack exploiting IE. 

[Figure 5] IE browser hooking code patch

The injected DLL calls for a browser-hooking patch function as shown in Figure 6. The code in the function uses the hooking function to hijack incoming and outgoing banking information through the web browser. 

Browser hooking functions in IE, Firefox, and Chrome are listed in [Table 1]. 

When a hooking function is initiated, Dyre attempts to access the bank website and checks for a connection with the C&C server as shown in [Figure 7]. The code also initiates keylogging through the codes patched in the GetMessageW() and PeekMessageW() functions. 

 
Targets continue to increase
[Figure 8] is an example of a screenshot that displays a list of banks targeted by Dyre. In addition, it contains a fake website that is used to redirect victim’s internet traffic. Based on the analysis conducted in April by AhnLab, approximately 500 banks were included in the current list that accompanies Dyre. In February, two Korean banks were discovered to have been added to the list and it is expected that the list of potential targets will continue to get longer.
 

The objectives of Dyre are to hijack financial information, hijack other personal information, and steal money. The threat was widely spread at the end of 2014 and although the internal code has not changed a lot, its external code changes constantly, making it difficult to detect and contain the impending damage.​