Shylock Malware Resurges, Targets Top U.S. Banks

Beware the latest version of the banking malware known as Shylock -- also called Caphaw -- which has been retooled to target customers of 24 different banks.

Security firm Zscaler reported Wednesday that over the last month it's seen the number of Shylock infections surge. While the malware was first spotted in 2011 and was seen earlier this year targeting European banking customers, the latest version of the Trojan application now targets customers of the four largest U.S. banks -- Chase Manhattan Corporation, Bank of America, Citi Private Bank and Wells Fargo -- as well as Bank of the West, Capital One, U.S. Bancorp and others.

Shylock is better than most banking malware, which typically siphons up a user's banking credentials and relays them to attackers for later use. "This is one of the few pieces of malware that can automatically steal money when the user is actively accessing his banking account," read an analysis of Caphaw published earlier this year by ESET security researcher Aleksandr Matrosov. Other malware with this capability includes Carberp, Gataka, Ranbyus and Tinba.

[ Use Internet Explorer? Be careful where you browse. See Microsoft: Beware IE Zero-Day Attacks. ]

Shylock, which hides in Windows Explorer, can also hook itself to the operating system in a way that allows it to control the reboot/shutdown process and makes it possible for the malware to restore itself after some antivirus cleaning procedures have been carried out, Matrosov said.

The previous iteration of Caphaw largely targeted banks in Britain, Denmark, Italy and Turkey.

To date, it's not clear how people are being infected with the latest version of Shylock, although Zscaler ThreatLabZ security researchers Sachin Deodhar and Chris Mannon said in a blog post that "it is more than likely arriving as part of an exploit kit [homing] in on vulnerable versions of Java." That's because infected devices that communicate with Shylock command-and-control (C&C) servers have an HTTP "user-agent" header listed as "Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_07." In other words, infected devices seen to date are running both Windows XP and a version of Java 6 that dates from 2008. Needless to say, that version of Java contains a number of known -- and exploitable -- vulnerabilities.

Don't expect antivirus software to reliably stop Shylock, since it's been built so that every infection looks slightly different to help it sneak past antivirus scanners. As of Wednesday, only one out of 46 antivirus scanners could detect the latest version of Shylock, though by Thursday 25 out of 48 scanners were spotting it. "The variation in the dropped executable is different across every instance, so it's no wonder standard AV is having a problem keeping up," said Zscaler's Deodhar and Mannon. "This AV performance also indicates that the likelihood of someone proactively catching this infection inside their network is fairly low at the time of this writing."

To further hide its activities, the malware also makes use of a domain generation algorithm, which keeps the malware's lines of communication -- encrypted via SSL -- synchronized with a constantly changing roster of C&C servers sporting quasi-random names. These servers receive stolen data, send commands to infected PCs, and can also push plug-ins that transform the infection into a rootkit, make a video recording of a user's PC session, allow the malware to spread via removable media and shared drives, and copy information from Microsoft Outlook personal folder (.pst) files.

Thanks to the C&C servers' quasi-random names, actually finding and shutting them down can be difficult. "The large number of potential rendezvous points with randomized names makes it extremely difficult for investigators and law enforcement agencies to identify and 'take down' the [C&C] infrastructure," said the Zscaler researchers. "Furthermore, by using encryption, it adds another layer of difficulty to the process of identifying and targeting the command and control assets."