Zeus/Wsnpoem/Zbot targets
I ran into an interesting Zbot sample today. I haven’t peeked at them often and I was surprised to see a big bunch of various poker sites in the configuration as stealing targets. That prompted me to do a quick search on zbots seen in the last few days and I ended up downloading the encrypted configuration files from the C&C servers that I saw were online. 22 of them active :)
So, I decrypted them quickly and here’s some summaries on targets on these 22 configuration files:
Seems like the spanish banks are for some reason widely targeted but what surprised more was that there are many .ru sites also targeted. Taking into consideration that it’s a russian trojan and many of the users are propably from Russia it’s a bit surprising to see since usually the skilled people tend not to operate in their own countries to make prosecution harder.
Anyway, here’s a list of targets in the 22 files. I didn’t bother counting how many of them are in several configurations and how many not.
After seeing this list it’s not hard to imagine how much damages these guys cause annually.
access.imb.com.au
activision.cc
addmoney.ru
adelaidebank.com.au
agent.e-port.ru
agent.osmp.ru
aib.ie
akbank.com.tr
alfabank.ru
ansmep.kiev.ua
appex.ru
apps.standardlife.com
areasegura.banif.es
aromamaslo.ru
rquia.es
assist.ru
atl.osmp.ru
bacckupc.com
banca.cajaen.es
banca.cajaguadalajara.biz
bancaja.es
bancamarch.es
bancaonline.openbank.es
bancocaixageral.es
bancoexterior.com
bancogallego.es
bancopastor.es
bancopopular.es
bancopostaonline.poste.it
banesconline.com
banesnet.banesto.es
bankcardservices.co.uk
bankdirect.co.nz
banking*.anz.com
banking.*.de
banking.first-direct.com
banking.postbank.de
banking.sparda.de
bankofscotlandhalifax-online.co.uk
barclays.es
bbk.es
bbva.es
bbvanetcash.com
bbvanetoffice.com
be.bancofar.es
be.cajasegovia.es
bestcredits.ru
betcity.ru
bnz.co.nz
brbg.ru
brokerage.comdirect.de
businessclassonline.compassbank.com
business-eb.ibanking-services.com
businessonline.westpac.com.au
bv-i.bancodevalencia.es
byro.ru
cai.es
caixacatalunya.es
caixadirecta.cgd.pt
caixa-enginyers.com
caixagestion.caixagalicia.es
caixalaietana.es
caixanova.es
caixaontinyent.es
caixasabadell.net
caixatarragona.es
cajabadajoz.es
cajacirculo.es
cajadeavila.es
cajaduero.es
cajaespana.net
cajaextremadura.es
caja-granada.es
caja-ingenieros.es
cajamadridempresas.es
cajamadrid.es
cajamar.es
cajamurcia.es
cajarioja.es
cajasegovia.es
cajasoldirecto.es
cajasur.es
cajavital.es
cambiossol.com
cam.es
capitalcity.combats.ru
cardsonline-consumer.com
carnet.cajarioja.es
cashmanagement.firstambank.com
cbs.*.com
cbs.firstcitizens.com
ccm.es
chaseonline.chase.com
cib.bankofthewest.com
cipehb*.cdg.citibank.de
citibank.es
citibank.ru
citizensbankmoneymanagergps.com
clavenet.net
clavenet.net
clickcashmoney.com
client-bank.privatbank.ua
colonya.es
co-operativebank.co.uk
cuviewpoint.net
cyberplat.ru
daib.dataaction.com.au
dealer.pegaspay.ru
dealer.x-plat.ru
deltakey.ru
denizbank.com
digiseller.ru
direct.53.com
direct.yandex.ru
easyweb*.tdcanadatrust.com
ebank.adcu.com.au
ebanking.danskebank.dk
ebgempresa.es
ebill.highmark.com
ebranch.easystreet.com.au
e-gold.com
egold.com
elecsnet.ru
elmonte.es
emoney.al.ru
emoney.kg
empay.ru
empresas.gruposantander.es
enlaza.cajadeburgos.es
enova.caixanova.es
enterprise2.openbank.com
erosol.cn
express.53.com
expressdeposit.colonialbank.com
express-systems.ru
extranet.banesto.es
factor2b.inetbank.net.au
factor2.inetbank.net.au
fareastnationalbank.ebanking-services.com
fibancmediolanum.es
filaaonw1mer.net
filmstvouty.info
finanzportal.fiducia.de
firstbanks.com
first-direct.com
firstfacts.mandtbank.com
firstplumb.info
floityuee1ws.net
fnbcms5.lionbank.com
fnc.asbbank.co.nz
foundthese.com
freecash.ru
freedom2mind.cn
ganjawars.ru
halifax-online.co.uk
hb.quiubi.it
home2ae.cd.citibank.ae
home.cbonline.co.uk
home.ybonline.co.uk
hsbc.co.uk
ib1.inetbank.net.au
ib2.inetbank.net.au
ib2.inetbank.net.au
ibank.bankphb.com
ibank.barclays.co.uk
ibank.bluestone.com.au
ibank.cahoot.com
ibank.caymannational.com
ibank.humebuild.com.au
ibanking.banksa.com.au
ibanking.ibtc.com
ibanking.stgeorge.com.au
ibank.internationalbanking.barclays.com
ibank.unionbankmo.com
ib.gatewaycu.com.au
icesave.co.uk
indiborge1.info
indiborge.com
indiborge.info
inetbnkp.adelaidebank.com.au
infoplus.mandtbank.com
ingdirect.com.au
ingdirect.com.au
installs.in
intelvia.cajamurcia.es
internetbanking.aib.ie
internetbanking.gad.de
internetbanking.suncorpmetway.com.au
internetbanking.unfcu.org
internetsube.akbank.com.tr
internet-systems.info
is2.cuviewpoint.net
itreasury.amsouth.com
kbbmb.ru
k-pay.ru
kreditpilot.com
ktt.key.com
kutxa.net
lacajadecanarias.es
light.webmoney.ru
lloydstsb.com
lloydstsb.co.uk
lo2.lacaixa.es
login.osmp.ru
login.yahoo.com
logitelnet.socgen.com
lacaixa.es
lolkahi123.biz
lot-port.bcs.ru
ltsbtis.com
*.lu
mail.yahoo.com
mbna.co.uk
mcbank.ru
membersequitybank.com.au
meradom.ru
mijn.postbank.nl
miwebcombank.ebanking-services.com
mkn.co.uk
mobilbank.ru
mobile.alfabank.ru
mobw.ru
moja.tatrabanka.sk
moneta.ru
moneybookers.com
money.mail.ru
*.moneymanagergps.com
money.yandex.ru
montevia.elmonte.es
mplategi.ru
multi-kassa.ru
mvp1.sccu.com.au
*mybank.alliance-leicester.co.uk
*mybank.alliance-leicester.co.uk*
*mybusinessbank.co.uk
my.if.com
*myonlineaccounts*.abbeynational.co.uk*
myteller.statewest.com*
*.nationet.com
netaccess2.qtcu.com.au
netaccess3.qtcu.com.au
netaccess.qtcu.com.au*
*netbank.commbank.com.au
netbank.communityfirst.com.au
netbank.selectcu.com.au
net.dataaction.com.au
net.dataaction.com.au*
netdirect.maitlandmutual.com.au
net.kutxa.net
netteller2.pncs.com.au
netteller2.tsw.com.au
netteller2.victeach.com.au
netteller3.pncs.com.au
netteller3.victeach.com.au
netteller.resourcescu.com.au
netteller.sydneycu.com.au
netteller.tsw.com.au
*npbs.co.uk
nswpower.com
oi.cajamadrid.es
oie.cajamadridempresas.es
olb2.nationet.com
online.arabbank.com.au*
online-a.unicreditbanca.it
onlinebanking.firsttrustbank.co.uk
onlinebanking.nationalcity.com
onlinebanking.norisbank.de
onlinebanking.wachovia.com
online-business.lloydstsb.co.uk
online.citibank.com
online.coastline.com.au
onlineeast.bankofamerica.com
online.hbs.net.au
online*.lloydstsb.co.uk
online.mecu.com.au
online.northernrock.com
online-offshore.lloydstsb.com
online.qantascu.com.au
online.savingsloans.com.au
onlinetreasurymanager.suntrust.com
online.wamu.com
online.wellsfargo.com
online.westpac.com.au
online.ybs.co.uk
*open24.ie
*.osmp.ru
parimatch.com
partner.grandcasino.ru
pastornetempresas.bancopastor.es
pastornetparticulares.bancopastor.es
payment.epos.ru
paymentsystems.ru
paymer.com
pcaccess.summerland.com.au*
*pecunix.com
*.pekaobiznes24.pl
permonline.newcastlepermanent.com.au
platix.ru
pncs.com.au
postipankki.co.uk
privat24.pbank.com.ua
privati.internetbanking.bancaintesa.it
probanking.procreditbank.bg
quickpay.ru
rapida.ru
*rbkmoney.ru
resources.chase.com
rupay.com
*.ruralvia.com
ruspay.ru
sauth.yandex.ru
*.savingsloans.com.au
saymag.co.cc
scrigno.popso.it*
secure.accu.com.au*
secure.e-bullion.com
secure.ingdirect.com
secure.ingdirect.co.uk
secure.islandstate.com*
secure.mystate.com.au
secure.mystate.com.au*
secure.partyaccount.com
secure.skype.com
server14.cey-ebanking.com
service.oneaccount.com
servizi.allianzbank.it*
sexi-bagdh.net
sex-porti.net
sitekey.bankofamerica.com
skype.com
*.smile.co.uk
*smile.co.uk
sms4pay.net
soccerlife.ru
ssl.bsk.com.pl
sso.uboc.com
*standardlife.com
suspendeddomain.cn
teleingenieros.caja-ingenieros.es
*telemarch.bancamarch.es
telematic.caixamanlleu.es
test.just.f1del.net
ticinternetsube.akbank.com.tr
*.todo1.com
transpay.ru
treas-mgt.frostbank.com
treasury.wamu.com
ukrmoney.com
*ulsterbankanytimebanking.*
*.unicaja.es
*unicaja.es
unikassa.ru
*uno-e.com*
*.vinea.es
vladromaff.narod.ru
vmoney.ru
vtb24.ru
web5.secureinternetbank.com
*webbanker.cua.com.au
web.da-us.citibank.com
web.secservizi.it
welcome22.smile.co.uk
welcome23.smile.co.uk
*welcome*.co-operativebank.co.uk*
westernunion.ru
*westpac.com*
*westpac.com.au
wfrules.ru
whoodoou.cn
wired2.businessmanager.com
www1.ibercajadirecto.com
www1.membersequitybank.com.au*
www2.bancopopular.es
www.365online.com
www.365online.co.uk
www3.altamiraonline.com
www3.netbank.commbank.com.au
www.53.com
www.abbeyinternational.com
www.abbeynational.co.uk
www.advance.com.au*
www.amgbank.com
www.ardil.bancogallego.es
www.asbbank.co.nz
www.bancaja.*
www.bancaja.es
www.bancajaproximaempresas.com
www.bancamediolanum.it
www.bancoherrero.com
www*.banking.first-direct.com
www.bankinter.com
www.bankline.natwest.com
www.bankline.rbs.com
www.bankmelb.com.au
www.bankofengland.co.uk
www.bankofscotland.co.uk
www.bankofscotlandhalifax-online.co.uk
www.barclays.co.uk
www.bblfm.com.au
www.bbva.es
www.bbva.es*
www.bbvanetoffice.com
www.bcs.ru
www.bgnetplus.com
www.birmingham-midshires.co.uk
www.bpmbanking.it
www.bradford-bingley.co.uk
www.bristol-west.co.uk
www.btal.com.au
www.businessonlineaccess.web-cashplus.com
www.bv-i.bancodevalencia.es
www.caixagirona.es
www.caixalaietana.es
www.caixalaietana.es*
www.caixanova.es
www.caixaontinyent.es
www.caixatarragona.es
www.cajabadajoz.es
www.cajacanarias.es
www.cajacirculo.es
www.cajadeavila.es
www.cajadeavila.es*
www.cajaduero.es
www.cajaespana.net
www.cajaextremadura.es
www.caja-granada.es
www.cajalaboral.com
www.cajasoldirecto.es
www.cajasur.es
www.cajavital.es
www.careermosaic.com
www.cashproweb.com
www.catovat.cn
www.ccm.es
www.cfgbusinessaccess.com
www.chebanca.it
www.cheltglos.co.uk
www.citibank.com.au*
www.citibank.de
www.citibank.de*
www.citizensbankonline.com
www#.citizensbankonline.com
www.clavenet.net
www.colonial.com.au
www.commercetreasurydirect.com
www.co-operativebank.co.uk
www.coventrybuildingsociety.co.uk
www.cpsinternetbanking.com.au
www.cpsinternetbanking.com.au*
www.creval.it
www.dab-bank.com*
www.dataaction.com.au
www.dataaction.com.au*
www.derbyshire.org
www.dresdner-privat.de
www.ebank.hsbc.co.uk
www.ebanking.baiduri.com.bn
www.ebrd.com
www.e-gold.com
www.enternetbank.com
www.epassporte.com
www.epay.bg
www.e-port.ru
www.e-rgonline.com
www.esavingsaccount.co.uk
www.fibancmediolanum.es
www.fiservla10.com
www.ftbni.com
www.gamebookers.com
www.gbw2.it
www.google.com
www.gruposantander.es
www.gruppocarige.it
www.halifax.co.uk
www.halifax-online.co.uk
www.hdb.co.uk
www.hsbc.co.uk
www.hsbcgroup.com
www.hsbcib.com
www.iblogin.com
www.in-biz.it*
www.ingdirect.com.au
www.ingdirect.es
www.isbank.com.tr
www.isideonline.it
www.iwbank.it
www.kbc.be
www.kiwibank.co.nz
www.labanquepostale.fr
www.libertymutualbusinessdirect.com
www.libertyreserve.com
www.lloydsbank.co.uk
www.lombard.co.uk
www.macquarie.com.au*
www.managerland.pl
www.metway.com.au
www.mhbs.co.uk
www.michiganbands.com
www.midlandbank.co.uk
www.millenet.pl
www.millenniumbcp.pt
www.moneybookers.com
www.moneymail.ru
www.mybank.alliance-leicester.co.uk
www.mybank.alliance-leicester.co.uk*
www.mybankfirstunited.wblnk.com
www.national.com.au*
www.nationwide.co.uk
www.natwest.co.uk
www.natwestoffshore.com
www.necu.com.au
www.netteller.com.au
www.nfbconnect.com
www.northern-bank.co.uk
www.nrock.co.uk
www.nwolb.com
www.offshorebanking.barclays.com
www.offshore.hsbc.co.uk
www.onlinebanking.iombank.com
www.onlinebanking.natwestoffshore.com
www.onlinebanking.pnc.com
www.open24.ie
www.paymer.com
www.paypal.com
www.pcunet2.com.au
www.pekao24.pl
www.portal.cajabadajoz.es
www.rbos.co.uk
www.rbsdigital.com
www.ruralvia.com
www.sabadellatlantico.com
www.sabbnet.com
www.sbil.co.uk
www.secure.bnpparibas.net
wwws.sanostra.es
www.stanchart.com*
www.statebanks.blilk.com
www.suntrust.com
www.tcorp.us
www.teacherscreditunion.com.au
www.treasury.pncbank.com
www.tsb.co.uk
www.ulsterbankanytimebanking.co.uk
www.unicaja.es
www.uno-e.com
www.usaa.com
www.usbank.com
www.us.hsbc.com
www.vr-networld-ebanking.de
www.wellsfargo.com
www.woolwich.co.uk
xpay.ru
xplat.ru
yandex.ru
zpay.ru
IF you read this far you have too much time :)
December 5th, 2008 at 5:37 pm
[…] - that modern banker malware is no longer exclusively targeting a particular E-banking site, but is targeting all of them simultaneously. “The Trusteer Attack Trace search engine allows IT professionals to submit their organization’s […]