Dyre/Dyreza Trojan

The popularity of banking Trojans amongst ill-minded persons continues to breed new offshoots like the Dyreza Trojan, a new PC threat of this subtype handling its distribution via non-targeted e-mail messages. Through the widely-used exploit of browser-hooking attacks, the Dyreza Trojan intercepts Web data and is designed to use such attacks to compromise bank accounts, much like ZeuS and its famed 'man in the middle' functions. Due to the Dyreza Trojan's limited symptoms and its inclusion of self-defensive functions meant to block its deletion, malware researchers only can encourage removing a Dyreza Trojan through the use of appropriate and fully-patched brands of anti-malware tools.

The Latest Trojan Heist of Online Banking Institutions

After enormous media attention through famous banking Trojans like ZeuS, the general public has had increased awareness of the existence of man-in-the-middle or man-in-the-browser attacks. These attacks are able to collect even SSL-encrypted information, and rarely show evidence of their existence to tip their victims off to the problem. The Dyreza Trojan is a recently-identified Trojan to make use of these same types of attacks, which base themselves on injecting threatening code into your browser's memory process (or 'hooking' it). At this time, Chrome, Firefox and Internet Explorer may be affected by a Dyreza Trojan.

The Dyreza Trojan, also known as Dyre, keeps track of your Web traffic and monitors both input into the browser and which sites you visit. The Dyreza Trojan especially may monitor online banking sites, including ones for the following companies:

• Bank of America
• Citigroup
• Natwest
• The Royal Bank of Scotland
• Ulsterbank

These attacks snatch passwords, login names and other, equally important information, including data with the protection of encryption. The data is transferred in plain text through the Dyreza Trojan's backdoor connection, which also may accept instructions on how to modify your browser's behavior or conduct other attacks. Although the PC user no longer is interacting with the official bank website, there are no symptoms from the Dyreza Trojan to indicate this massive breach of security.

Of course, malware experts rate the potential for bank account hijacks and fraudulent financial transactions to be extremely high. However, the Dyreza Trojan's network connection also may be used for other, equally threatening ends, like installing new threats.

Preventing a Dire Trojan from Taking Your Payday

The Dyreza Trojan uses both code obfuscation techniques and data compression to prevent PC security tools from recognizing the Dyreza Trojan, although malware experts have found reasonable detection rates of the Dyreza Trojan from updated anti-malware products. However, besides the obvious use of anti-malware tools for deleting a Dyreza Trojan, your bank accounts, naturally, are safer when you can prevent the Dyreza Trojan from compromising your PC at all.

When it comes to the latter, malware researchers recommend avoiding Flash 'updates' from suspicious pop-ups and sites that could include unsafe, script-based content, that may be the ones to be blamed for a wide extent of threat installers. The Dyreza Trojan campaign also makes especially heavy use of spam e-mail messages, which, tellingly, are disguised to resemble bank notifications and warnings about rejected tax payments. PC users who aren't susceptible to downloading ZIP-based file attachments from these sources shouldn't expect themselves to be easily targeted by the Dyreza Trojan's current distribution tactics.

Technical Details