Malwarecritical
2016 Updates to Shifu Banking Trojan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-0167 | Win32k Local Privilege Escalation in Microsoft Windows (Vista through 10 1511) | 7.8 | 6% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 003965bd25acb7e8c6e16de4f387ff9518db7bcca845502d23b6505d8d3cec01 | 2eebf143617708bfdd0fe31cbf00ef12383f9 Second stage injector 003965bd25acb7e8c6e16de4f387ff9518db7bcca845502d23b6505d8d3cec01 1188c5c9f04658bef20162f3001d9b89f69c93bf5343a1f849974daf628 |
| sha256 | 1188c5c9f04658bef20162f3001d9b89f69c93bf5343a1f849974daf6284a650 | 5bd25acb7e8c6e16de4f387ff9518db7bcca845502d23b6505d8d3cec01 1188c5c9f04658bef20162f3001d9b89f69c93bf5343a1f849974daf6284a650 Exploit injector e7c1523d93154462ed9e15e84d3af01abe827aa6dd |
| sha256 | 368b23e6d9ec7843e537e9d6547777088cf36581076599d04846287a9162652b | 4037f8b4d24f2baff1e0940d2bf238032f9343d06478b5034d0981b2cd9 368b23e6d9ec7843e537e9d6547777088cf36581076599d04846287a9162652b e7e154c65417f5594a8b4602db601ac39156b5758889f708dac7258e415 |
| sha256 | 5124f4fec24acb2c83f26d1e70d7c525daac6c9fb6e2262ed1c1c52c88636bad | e827aa6dd0082bc90fc8b58989e9a9a CVE-2016-0167 exploit (x86) 5124f4fec24acb2c83f26d1e70d7c525daac6c9fb6e2262ed1c1c52c88636bad CVE-2016-0167 exploit (x64) f3c2d4090f6f563928e9a9ec86bf0f1 |
| sha256 | 5ca2a9de65c998b0d0a0a01b4aa103a9410d76ab86c75d7b968984be53e279b6 | 375f9b0b95f385191895edf81c8eadfb3964204bbbe48f7700fc746e4dc 5ca2a9de65c998b0d0a0a01b4aa103a9410d76ab86c75d7b968984be53e279b6 Appendix - Technical details Second Stage Injector Analysis |
| sha256 | d3f9c4037f8b4d24f2baff1e0940d2bf238032f9343d06478b5034d0981b2cd9 | HA256 Hashes of Samples Discussed Initial obfuscated loader d3f9c4037f8b4d24f2baff1e0940d2bf238032f9343d06478b5034d0981b2cd9 368b23e6d9ec7843e537e9d6547777088cf36581076599d04846287a916 |
| sha256 | e7c1523d93154462ed9e15e84d3af01abe827aa6dd0082bc90fc8b58989e9a9a | f3001d9b89f69c93bf5343a1f849974daf6284a650 Exploit injector e7c1523d93154462ed9e15e84d3af01abe827aa6dd0082bc90fc8b58989e9a9a CVE-2016-0167 exploit (x86) 5124f4fec24acb2c83f26d1e70d7c52 |
| sha256 | e7e154c65417f5594a8b4602db601ac39156b5758889f708dac7258e415d4a18 | 3e6d9ec7843e537e9d6547777088cf36581076599d04846287a9162652b e7e154c65417f5594a8b4602db601ac39156b5758889f708dac7258e415d4a18 f63ec1e5752eb8b9a07104f42392eebf143617708bfdd0fe31cbf00ef12 |
| sha256 | e9bd4375f9b0b95f385191895edf81c8eadfb3964204bbbe48f7700fc746e4dc | e9a9ec86bf0f1c6ee49cdc110b7368db8905781a9a966e Main payload e9bd4375f9b0b95f385191895edf81c8eadfb3964204bbbe48f7700fc746e4dc 5ca2a9de65c998b0d0a0a01b4aa103a9410d76ab86c75d7b968984be53e |
| sha256 | f3c2d4090f6f563928e9a9ec86bf0f1c6ee49cdc110b7368db8905781a9a966e | aac6c9fb6e2262ed1c1c52c88636bad CVE-2016-0167 exploit (x64) f3c2d4090f6f563928e9a9ec86bf0f1c6ee49cdc110b7368db8905781a9a966e Main payload e9bd4375f9b0b95f385191895edf81c8eadfb3964204bb |
| sha256 | f63ec1e5752eb8b9a07104f42392eebf143617708bfdd0fe31cbf00ef12383f9 | 4c65417f5594a8b4602db601ac39156b5758889f708dac7258e415d4a18 f63ec1e5752eb8b9a07104f42392eebf143617708bfdd0fe31cbf00ef12383f9 Second stage injector 003965bd25acb7e8c6e16de4f387ff9518db7 |
From the original article
15 min read at unit42.paloaltonetworks.com
Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, Italy, and others.
By Dominik Reichel · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.