SYMBOLCOMMON_NAMEaka. SYNONYMS
win.spyeye (Back to overview)

SpyEye

VTCollection    

SpyEye is a malware targeting both Microsoft Windows browsers and Apple iOS Safari. Originated in Russia, it was available in dark forums for $500+ claiming to be the "The Next Zeus Malware". It performed many functionalities typical from bankers trojan such as keyloggers, auto-fill credit card modules, email backups, config files (encrypted), http access, Pop3 grabbers and FTP grabbers. SpyEye allowed hackers to steal money from online bank accounts and initiate transactions even while valid users are logged into their bank account.

References
2021-05-07Department of JusticeOffice of Public Affairs
Four Individuals Plead Guilty to RICO Conspiracy Involving “Bulletproof Hosting” for Cybercriminals
Citadel SpyEye Zeus
2021-03-31KasperskyKaspersky
Financial Cyberthreats in 2020
BetaBot DanaBot Emotet Gozi Ramnit RTM SpyEye TrickBot Zeus
2020-08-09F5 LabsDebbie Walkowski, Remi Cohen
Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2017-09-15MicrosoftMicrosoft
Trojan:Win32/Spyeye
SpyEye
2012-01-04PCWorldJeremy Kirk
SpyEye Malware Borrows Zeus Trick to Mask Fraud
SpyEye
2011-07-26ComputerworldJeremy Kirk
SpyEye Trojan defeating online banking defenses
SpyEye
2011-04-26Brian Krebs
SpyEye Targets Opera, Google Chrome Users
SpyEye
2010-09-17KrebsOnSecurityBrian Krebs
SpyEye Botnet’s Bogus Billing Feature
SpyEye
2010-06-15SANSHarshit Nayyar
Clash of the Titans: ZeuS v SpyEye
SpyEye
2010-04-01KrebsOnSecurityBrian Krebs
SpyEye vs. ZeuS Rivalry
SpyEye
2010-02-19MalwareIntelligenceJorge Mieres
SpyEye Bot (Part two). Conversations with the creator of crimeware
SpyEye
2010-02-04SymantecPeter Coogan
SpyEye Bot versus Zeus Bot
SpyEye
Yara Rules
[TLP:WHITE] win_spyeye_auto (20230808 | Detects win.spyeye.)
rule win_spyeye_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.spyeye."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyeye"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d4de8 51 8d4de0 51 50 e8???????? 85c0 }
            // n = 7, score = 700
            //   8d4de8               | lea                 ecx, [ebp - 0x18]
            //   51                   | push                ecx
            //   8d4de0               | lea                 ecx, [ebp - 0x20]
            //   51                   | push                ecx
            //   50                   | push                eax
            //   e8????????           |                     
            //   85c0                 | test                eax, eax

        $sequence_1 = { 6a07 6800000040 57 e8???????? 8bf8 83ffff }
            // n = 6, score = 700
            //   6a07                 | push                7
            //   6800000040           | push                0x40000000
            //   57                   | push                edi
            //   e8????????           |                     
            //   8bf8                 | mov                 edi, eax
            //   83ffff               | cmp                 edi, -1

        $sequence_2 = { 6889000000 ff7508 33db 897df8 }
            // n = 4, score = 700
            //   6889000000           | push                0x89
            //   ff7508               | push                dword ptr [ebp + 8]
            //   33db                 | xor                 ebx, ebx
            //   897df8               | mov                 dword ptr [ebp - 8], edi

        $sequence_3 = { 57 6800000002 6a03 57 6a01 56 }
            // n = 6, score = 700
            //   57                   | push                edi
            //   6800000002           | push                0x2000000
            //   6a03                 | push                3
            //   57                   | push                edi
            //   6a01                 | push                1
            //   56                   | push                esi

        $sequence_4 = { 56 6880000000 6a02 eb08 56 6880000000 6a04 }
            // n = 7, score = 700
            //   56                   | push                esi
            //   6880000000           | push                0x80
            //   6a02                 | push                2
            //   eb08                 | jmp                 0xa
            //   56                   | push                esi
            //   6880000000           | push                0x80
            //   6a04                 | push                4

        $sequence_5 = { 85c0 7407 c745f801000000 397dfc 740e }
            // n = 5, score = 700
            //   85c0                 | test                eax, eax
            //   7407                 | je                  9
            //   c745f801000000       | mov                 dword ptr [ebp - 8], 1
            //   397dfc               | cmp                 dword ptr [ebp - 4], edi
            //   740e                 | je                  0x10

        $sequence_6 = { be80000000 56 6a03 57 6a01 6889000000 ff7508 }
            // n = 7, score = 700
            //   be80000000           | mov                 esi, 0x80
            //   56                   | push                esi
            //   6a03                 | push                3
            //   57                   | push                edi
            //   6a01                 | push                1
            //   6889000000           | push                0x89
            //   ff7508               | push                dword ptr [ebp + 8]

        $sequence_7 = { 53 e8???????? 85c0 7407 c745f801000000 397dfc 740e }
            // n = 7, score = 700
            //   53                   | push                ebx
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7407                 | je                  9
            //   c745f801000000       | mov                 dword ptr [ebp - 8], 1
            //   397dfc               | cmp                 dword ptr [ebp - 4], edi
            //   740e                 | je                  0x10

        $sequence_8 = { 8965fc ff7510 ff750c ff7508 ffd0 8b65fc }
            // n = 6, score = 700
            //   8965fc               | mov                 dword ptr [ebp - 4], esp
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   ff7508               | push                dword ptr [ebp + 8]
            //   ffd0                 | call                eax
            //   8b65fc               | mov                 esp, dword ptr [ebp - 4]

        $sequence_9 = { 7454 57 56 6a03 }
            // n = 4, score = 700
            //   7454                 | je                  0x56
            //   57                   | push                edi
            //   56                   | push                esi
            //   6a03                 | push                3

    condition:
        7 of them and filesize < 741376
}
Download all Yara Rules