Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

2016 Updates to Shifu Banking Trojan

Summary: Unit 42 research found that the authors of Shifu, a banking Trojan first discovered in 2015 and based on the Shiz source code, evolved it in 2016 with new techniques to infect and evade detection on Windows systems. The analyzed version, compiled in June 2016, uses a multi-stage loader, carries two exploits for CVE-2016-0167 with a February 2016 compilation timestamp, and contacts its command-and-control server through .bit top-level domains.

Bottom line: The exploit's February 2016 timestamp predates available patches, and a Vawtrak sample compiled in January 2016 already carried an earlier version of it - meaning this Windows vulnerability was in criminal hands before defenders could patch it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Mentions
CVE-2016-0167
Related
CVE-2016-0167: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021