SYMBOLCOMMON_NAMEaka. SYNONYMS
win.vawtrak (Back to overview)

Vawtrak

aka: Catch, grabnew, NeverQuest

Actor(s): Lunar Spider

URLhaus    

There is no description at this point.

References
2021-09-03Trend MicroMohamad Mokbel
@techreport{mokbel:20210903:state:df86499, author = {Mohamad Mokbel}, title = {{The State of SSL/TLS Certificate Usage in Malware C&C Communications}}, date = {2021-09-03}, institution = {Trend Micro}, url = {https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf}, language = {English}, urldate = {2021-09-19} } The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2020-08-09F5 LabsRemi Cohen, Debbie Walkowski
@online{cohen:20200809:banking:8718999, author = {Remi Cohen and Debbie Walkowski}, title = {{Banking Trojans: A Reference Guide to the Malware Family Tree}}, date = {2020-08-09}, organization = {F5 Labs}, url = {https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree}, language = {English}, urldate = {2021-06-29} } Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2019-02-15CrowdStrikeBrendon Feeley, Bex Hartley
@online{feeley:20190215:sinful:729f693, author = {Brendon Feeley and Bex Hartley}, title = {{“Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web}}, date = {2019-02-15}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/}, language = {English}, urldate = {2019-12-20} } “Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web
Dyre IcedID TrickBot Vawtrak LUNAR SPIDER WIZARD SPIDER
2018-08-09Fox-ITAlfred Klason
@online{klason:20180809:bokbot:499f316, author = {Alfred Klason}, title = {{Bokbot: The (re)birth of a banker}}, date = {2018-08-09}, organization = {Fox-IT}, url = {https://blog.fox-it.com/2018/08/09/bokbot-the-rebirth-of-a-banker/}, language = {English}, urldate = {2019-12-20} } Bokbot: The (re)birth of a banker
IcedID Vawtrak
2017-01-22The Hacker NewsMohit Kumar
@online{kumar:20170122:russian:a19c81e, author = {Mohit Kumar}, title = {{Russian Hacker behind 'NeverQuest' Malware, Wanted by FBI, Is Arrested in Spain}}, date = {2017-01-22}, organization = {The Hacker News}, url = {http://thehackernews.com/2017/01/neverquest-fbi-hacker.html}, language = {English}, urldate = {2019-12-18} } Russian Hacker behind 'NeverQuest' Malware, Wanted by FBI, Is Arrested in Spain
Vawtrak
2016-09BluelivBlueliv
@techreport{blueliv:201609:chasing:1c02f62, author = {Blueliv}, title = {{Chasing Cybercrime: Network insights into Vawtrak v2}}, date = {2016-09}, institution = {Blueliv}, url = {https://www.blueliv.com/downloads/network-insights-into-vawtrak-v2.pdf}, language = {English}, urldate = {2020-01-07} } Chasing Cybercrime: Network insights into Vawtrak v2
Vawtrak
2016-07-12Fidelis CybersecurityThreat Research Team
@online{team:20160712:me:d8f4707, author = {Threat Research Team}, title = {{Me and Mr. Robot: Tracking the Actor Behind the MAN1 Crypter}}, date = {2016-07-12}, organization = {Fidelis Cybersecurity}, url = {https://fidelissecurity.com/threatgeek/archive/me-and-mr-robot-tracking-actor-behind-man1-crypter/}, language = {English}, urldate = {2021-07-29} } Me and Mr. Robot: Tracking the Actor Behind the MAN1 Crypter
Hancitor Vawtrak
2016-04-21ThreatpostTom Spring
@online{spring:20160421:pos:008ddcb, author = {Tom Spring}, title = {{PoS Attacks Net Crooks 20 Million Stolen Bank Cards}}, date = {2016-04-21}, organization = {Threatpost}, url = {https://threatpost.com/pos-attacks-net-crooks-20-million-stolen-bank-cards/117595/}, language = {English}, urldate = {2020-01-10} } PoS Attacks Net Crooks 20 Million Stolen Bank Cards
Vawtrak
2014-12-19PhishLabsDon Jackson
@online{jackson:20141219:unrelenting:f3f3ccf, author = {Don Jackson}, title = {{The unrelenting evolution of Vawtrak}}, date = {2014-12-19}, organization = {PhishLabs}, url = {https://info.phishlabs.com/blog/the-unrelenting-evolution-of-vawtrak}, language = {English}, urldate = {2019-11-04} } The unrelenting evolution of Vawtrak
Vawtrak
2014-12-17SecureworksBrett Stone-Gross, Pallav Khandhar
@online{stonegross:20141217:dyre:8486e19, author = {Brett Stone-Gross and Pallav Khandhar}, title = {{Dyre Banking Trojan}}, date = {2014-12-17}, organization = {Secureworks}, url = {https://www.secureworks.com/research/dyre-banking-trojan}, language = {English}, urldate = {2021-05-28} } Dyre Banking Trojan
Dyre Vawtrak WIZARD SPIDER
Yara Rules
[TLP:WHITE] win_vawtrak_auto (20211008 | Detects win.vawtrak.)
rule win_vawtrak_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.vawtrak."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vawtrak"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a01 ff35???????? 6a04 6a01 }
            // n = 4, score = 2600
            //   6a01                 | push                1
            //   ff35????????         |                     
            //   6a04                 | push                4
            //   6a01                 | push                1

        $sequence_1 = { 6a04 6a01 50 ff15???????? 85c0 }
            // n = 5, score = 2600
            //   6a04                 | push                4
            //   6a01                 | push                1
            //   50                   | push                eax
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax

        $sequence_2 = { 50 6a00 6a00 e8???????? 50 ff15???????? }
            // n = 6, score = 2600
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   e8????????           |                     
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_3 = { ff15???????? 6800000001 6aff 68???????? }
            // n = 4, score = 2400
            //   ff15????????         |                     
            //   6800000001           | push                0x1000000
            //   6aff                 | push                -1
            //   68????????           |                     

        $sequence_4 = { ff15???????? f7d8 1bc0 f7d8 eb02 33c0 8be5 }
            // n = 7, score = 2400
            //   ff15????????         |                     
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   f7d8                 | neg                 eax
            //   eb02                 | jmp                 4
            //   33c0                 | xor                 eax, eax
            //   8be5                 | mov                 esp, ebp

        $sequence_5 = { ffd7 33f6 46 eb02 33f6 }
            // n = 5, score = 2400
            //   ffd7                 | call                edi
            //   33f6                 | xor                 esi, esi
            //   46                   | inc                 esi
            //   eb02                 | jmp                 4
            //   33f6                 | xor                 esi, esi

        $sequence_6 = { ff15???????? 85c0 740a 50 ff15???????? 33c0 40 }
            // n = 7, score = 2400
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   740a                 | je                  0xc
            //   50                   | push                eax
            //   ff15????????         |                     
            //   33c0                 | xor                 eax, eax
            //   40                   | inc                 eax

        $sequence_7 = { ba00ff0000 8bc1 23c2 3bc2 }
            // n = 4, score = 2400
            //   ba00ff0000           | xor                 eax, eax
            //   8bc1                 | mov                 ecx, 0x80000000
            //   23c2                 | inc                 eax
            //   3bc2                 | mov                 dword ptr [ecx], eax

        $sequence_8 = { ff15???????? eb01 47 81ff00280000 }
            // n = 4, score = 2400
            //   ff15????????         |                     
            //   eb01                 | jmp                 3
            //   47                   | inc                 edi
            //   81ff00280000         | cmp                 edi, 0x2800

        $sequence_9 = { 7516 c705????????02000000 c705????????03000000 eb14 }
            // n = 4, score = 2200
            //   7516                 | cmp                 eax, edx
            //   c705????????02000000     |     
            //   c705????????03000000     |     
            //   eb14                 | je                  7

        $sequence_10 = { e8???????? 803d????????00 7405 e8???????? e8???????? e8???????? }
            // n = 6, score = 2200
            //   e8????????           |                     
            //   803d????????00       |                     
            //   7405                 | sub                 ecx, 0x1000
            //   e8????????           |                     
            //   e8????????           |                     
            //   e8????????           |                     

        $sequence_11 = { b8ff0f0000 6623e8 b800400000 660be8 }
            // n = 4, score = 2200
            //   b8ff0f0000           | jne                 0x18
            //   6623e8               | jmp                 0x18
            //   b800400000           | test                al, 4
            //   660be8               | je                  9

        $sequence_12 = { 7528 68???????? ff15???????? 85c0 7504 }
            // n = 5, score = 2000
            //   7528                 | push                1
            //   68????????           |                     
            //   ff15????????         |                     
            //   85c0                 | push                8
            //   7504                 | push                esi

        $sequence_13 = { 50 ff15???????? a3???????? 85c0 74e7 }
            // n = 5, score = 2000
            //   50                   | call                edi
            //   ff15????????         |                     
            //   a3????????           |                     
            //   85c0                 | test                eax, eax
            //   74e7                 | jne                 0x2a

        $sequence_14 = { 6a08 68???????? 56 ffd7 85c0 }
            // n = 5, score = 2000
            //   6a08                 | push                0
            //   68????????           |                     
            //   56                   | push                eax
            //   ffd7                 | push                1
            //   85c0                 | push                4

        $sequence_15 = { 59 57 8bf0 ff15???????? 8bc6 }
            // n = 5, score = 1900
            //   59                   | test                eax, eax
            //   57                   | je                  0xffffffe9
            //   8bf0                 | xor                 edx, edx
            //   ff15????????         |                     
            //   8bc6                 | mov                 ecx, 0x3fff

        $sequence_16 = { 8bc6 8703 3bc6 74f8 }
            // n = 4, score = 1900
            //   8bc6                 | mov                 eax, esi
            //   8703                 | xchg                dword ptr [ebx], eax
            //   3bc6                 | cmp                 eax, esi
            //   74f8                 | je                  0xfffffffa

        $sequence_17 = { e8???????? 33d2 b9ff3f0000 f7f1 }
            // n = 4, score = 1900
            //   e8????????           |                     
            //   33d2                 | test                eax, eax
            //   b9ff3f0000           | jne                 0xa
            //   f7f1                 | xor                 eax, eax

        $sequence_18 = { 7705 80ea61 eb0a 8d42bf 3c0f }
            // n = 5, score = 1700
            //   7705                 | cmp                 eax, edx
            //   80ea61               | mov                 eax, esi
            //   eb0a                 | xchg                dword ptr [ebx], eax
            //   8d42bf               | cmp                 eax, esi
            //   3c0f                 | je                  0xfffffffc

        $sequence_19 = { e9???????? 8ac1 c1e904 c0e004 }
            // n = 4, score = 1200
            //   e9????????           |                     
            //   8ac1                 | mov                 al, cl
            //   c1e904               | shr                 ecx, 4
            //   c0e004               | shl                 al, 4

        $sequence_20 = { 8ac8 240f 80e1f0 80c110 }
            // n = 4, score = 900
            //   8ac8                 | mov                 cl, al
            //   240f                 | and                 al, 0xf
            //   80e1f0               | and                 cl, 0xf0
            //   80c110               | add                 cl, 0x10

        $sequence_21 = { 3c41 7c11 3c46 7f0d }
            // n = 4, score = 800
            //   3c41                 | cmp                 al, 0x41
            //   7c11                 | jl                  0x13
            //   3c46                 | cmp                 al, 0x46
            //   7f0d                 | jg                  0xf

        $sequence_22 = { b801000000 8705???????? 83f801 74f0 e8???????? }
            // n = 5, score = 700
            //   b801000000           | xor                 edx, edx
            //   8705????????         |                     
            //   83f801               | mov                 eax, 1
            //   74f0                 | cmp                 eax, 1
            //   e8????????           |                     

        $sequence_23 = { 83f801 74f0 488b0d???????? 4885c9 7405 }
            // n = 5, score = 700
            //   83f801               | je                  0xfffffff2
            //   74f0                 | cmp                 eax, 1
            //   488b0d????????       |                     
            //   4885c9               | je                  0xfffffff2
            //   7405                 | dec                 eax

        $sequence_24 = { 4585c0 7408 ff15???????? 8bf0 33d2 }
            // n = 5, score = 700
            //   4585c0               | inc                 ebp
            //   7408                 | test                eax, eax
            //   ff15????????         |                     
            //   8bf0                 | je                  0xa
            //   33d2                 | mov                 esi, eax

        $sequence_25 = { ff15???????? 488bcb e8???????? 33c0 488b5c2440 }
            // n = 5, score = 700
            //   ff15????????         |                     
            //   488bcb               | test                ecx, ecx
            //   e8????????           |                     
            //   33c0                 | je                  7
            //   488b5c2440           | dec                 eax

    condition:
        7 of them and filesize < 1027072
}
Download all Yara Rules