Loading malware…
Shifu is a Windows banking Trojan first identified in 2015 and widely assessed as derived from the Shiz codebase while incorporating techniques associated with Zeus-era banking malware. It was used to steal credentials and other sensitive data from online banking users, initially focusing on Russia and later expanding to targets in countries including the United Kingdom, Italy, Japan, and Spain. Campaign reporting also links its distribution to large spam operations associated with TA505 and to exploit-kit delivery in some periods.
Shifu combines banking fraud functionality with broad post-compromise collection and evasion features. It injects into legitimate Windows processes, propagates its payload across multiple running processes, and uses inter-process communication to coordinate activity. Documented theft capabilities include keylogging, clipboard capture, screenshot capture to defeat virtual keyboards, interception of imported certificates and associated passwords, theft of cryptocurrency wallets, and collection of VPN, VNC, FTP, and POP3 credentials. It also contains logic to identify systems associated with financial or point-of-sale environments.
The malware employs extensive defense-evasion and anti-analysis measures, including anti-sandbox and anti-virtualization checks, obfuscated strings and imports, user-mode process-hiding hooks, and browser or certificate-validation tampering to support man-in-the-middle style webinject operations. Some variants attempted local privilege escalation through CVE-2015-0003, while later versions incorporated CVE-2016-0167. Shifu also supported downloading additional modules, silently deploying a local Apache server for webinject functionality, redirecting browser traffic to that local server, and forcing certificate checks to succeed in targeted contexts.
Persistence and execution methods observed in later variants include a multi-stage loader and injector architecture, copying the loader into user- or system-writable locations, and creating a startup script to relaunch it. Command-and-control traffic has been described as RC4-obfuscated, with some variants using Namecoin .bit domains. Shifu has also been noted for HTTPS interception detection logic intended to avoid operating in monitored environments. In addition to credential theft and banking fraud, it included a destructive self-removal capability capable of damaging removable media and filesystem structures.
Shifu is best classified as a banking Trojan targeting Microsoft Windows systems, with delivery observed through malicious spam campaigns using macro-enabled Office documents and through exploit-kit activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
At the entry point, we can immediately tell that Shifu attempts to exploit a local privilege escalation vulnerability. The vulnerability was assigned the CVE number CVE-2015-0003 in February 2015 and can be used to elevate the privilege of a process to system privilege on Windows 7 and above. The exploit code can easily be found on the Internet, so it is not surprising that the malware attempts to exploit this (patched) vulnerability. | Following takedown operations against various notorious banking trojans, including Zeus, Dridex and Gozi, a freshly brewed banking trojan, Shifu, has recently made the news; we believe it inherits some features from the earlier well-known banking trojans.
Some of these include: Exploitation of CVE-2016-0167 a Microsoft Windows Privilege Escalation vulnerability to gain SYSTEM level privileges. The second stage injector contains two exploits for CVE-2016-0167 (x86/x64)... At the time of compilation, patches were not yet available for this vulnerability. | Overview Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, Italy, and others.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In October 2015, we observed several campaigns in which TA505 targeted Japanese and UK organizations with the Shifu banking Trojan.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
Shifu tries to steal VPN and VNC login credentials by checking the command line of running executables.
The file contains the following code which runs the initial loader after the system was rebooted: var yqvltidpue = new ActiveXObject ( "WScript.Shell" ) ; yqvltidpue . Run ( "C:\\PROGRA~3\\930d4a6d.exe" )
The attachments are Microsoft Office documents containing malicious macros which download Shifu banking Trojan... Australian-targeted emails containing randomly named attachments that used malicious macros to download Ursnif. | Most of the emailed malicious document attachments are empty or used a generic 'Enable macros to view this document' lure.
Afterwards, a named pipe will be created in order to allow communication between the payloads in different processes.
Like in the previous version, the malware hooks some API functions to redirect URLs, capture network traffic, the clipboard and to log keystrokes. It uses a technique known as inline function hooking where the first 5 bytes of a function get patched with a jump to the malware's hook handlers.
All third-party browser plug-ins will be disabled immediately via a single registry value, ‘Enable Browser Extensions’... In addition to disabling third-party IE plug-ins, it also disables the pop-up blocker in IE through a registry key
Shifu’s author implements an additional routine which will create or spawn a random Windows process found in C:\Windows\system32, or in C:\Windows\syswow64 if it is a 64-bit platform. In order to circumvent this behaviour, Shifu first creates a suspended Windows process and then injects an infinite sleep, Sleep(-1), routine
As persistence method, the main payload copies the initial loader to the AppData folder and creates a Jscript file inside the Startup folder which points to it | the resulting encrypted data are written to registry for persistence purposes under the key "HKCU\software\microsoft\windows" with a random CRC32 hash name
Shifu will first try injecting the payload code into explorer.exe... Once the targeted process has been determined, Shifu will carry out another code injection routine to execute the payload via CreateRemoteThread or RtlCreateUserThread.
At the entry point, we can immediately tell that Shifu attempts to exploit a local privilege escalation vulnerability. The vulnerability was assigned the CVE number CVE-2015-0003 in February 2015 and can be used to elevate the privilege of a process to system privilege on Windows 7 and above.
Shifu’s author implements an additional routine which will create or spawn a random Windows process found in C:\Windows\system32, or in C:\Windows\syswow64 if it is a 64-bit platform. In order to circumvent this behaviour, Shifu first creates a suspended Windows process and then injects an infinite sleep, Sleep(-1), routine
As persistence method, the main payload copies the initial loader to the AppData folder and creates a Jscript file inside the Startup folder which points to it | the resulting encrypted data are written to registry for persistence purposes under the key "HKCU\software\microsoft\windows" with a random CRC32 hash name
Use of “push-calc-ret” API obfuscation to hide function calls from malware analysts
Shifu will first try injecting the payload code into explorer.exe... Once the targeted process has been determined, Shifu will carry out another code injection routine to execute the payload via CreateRemoteThread or RtlCreateUserThread.
This module allows the botherder to make the botnet clean up Flash cookies found in the %APPDATA%\Macromedia folder to cover the presence of the exploited Flash files.
At last, a batch file is created and executed in the %TEMP% folder. It overwrites the original executed initial loader with a random number of bytes to cover the tracks.
we observed that the dropper code is not heavily obfuscated, although most of the strings are encoded; it turns out that the strings can easily be decoded using a simple XOR operation.
There are many anti-sandbox and anti-VM detection techniques in the dropper... Shifu checks a list of active processes running on the machine, as well as the sample’s file name, against hard-coded CRC32 hashes in order to avoid the malware being analysed by a sandbox or by virtual machines
it no longer connects to the C&C server on machines that are found to have Man-in-the-Middle (MitM) interception for HTTPS connections. It makes this check by comparing the certificate’s MD5 fingerprint with those of some well-known websites
The malware conceals its presence from the running processes by hijacking the Windows ntdll!ZwQuerySystemInformation API, which is called whenever a user-mode program attempts to enumerate a list of active processes
Like in the previous version, the malware hooks some API functions to redirect URLs, capture network traffic, the clipboard and to log keystrokes. It uses a technique known as inline function hooking where the first 5 bytes of a function get patched with a jump to the malware's hook handlers.
Like in the previous version, the malware hooks some API functions to redirect URLs, capture network traffic, the clipboard and to log keystrokes.
Shifu also tries to capture virtual keyboards, which are commonly used in Internet banking, by taking screenshots of the infected machine whenever the malware detects a mouse click.
Redirect all the HTTP/HTTPS traffic to a local HTTP server to carry out man-in-the-middle operation
Shifu manipulates Windows API hooks in order to intercept the certificate password when a certificate is being imported to the certificate store. All the certificate blob data and passwords found in the Crypt32!PFXImportCertStore API will be intercepted
There are many anti-sandbox and anti-VM detection techniques in the dropper... Shifu checks a list of active processes running on the machine, as well as the sample’s file name, against hard-coded CRC32 hashes in order to avoid the malware being analysed by a sandbox or by virtual machines
Shifu also targets Bitcoin and Litecoin wallet files found on the victim’s machine. Shifu tries to steal VPN and VNC login credentials by checking the command line of running executables... Shifu attempts to save a copy of the configuration file.
Like in the previous version, the malware hooks some API functions to redirect URLs, capture network traffic, the clipboard and to log keystrokes.
Shifu also tries to capture virtual keyboards, which are commonly used in Internet banking, by taking screenshots of the infected machine whenever the malware detects a mouse click.
Shifu also tries to capture virtual keyboards... by taking screenshots of the infected machine whenever the malware detects a mouse click.
User32!GetClipboardData Captures the ASCII and UNICODE text currently saved in the clipboard window
All the data sent and received is obfuscated to prevent direct exposure by a packet sniffer program. The data is encoded and decoded using the RC4 algorithm
Over the last six years there has been an increased shift by malware authors to secure their C&C communications using the SSL/TLS protocol to stymie detection and blend in with normal traffic.
The main payload uses .bit top-level domains to contact its C&C server.
ws2_32!connect ws2_32!connectEx Redirect all the HTTP/HTTPS traffic to a local HTTP server to carry out man-in-the-middle operation
the malware will first modify and make sure the Apache server is properly configured by setting the server’s address to localhost (127.0.0.1) using a random port for both HTTP and HTTPS.
The main payload will download the Apache httpd.exe server file from one of the C&C servers to store it on disk for web injection purposes.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
PC banking trojan listed among malware actively used to attack companies.
Banking trojan mentioned for technical comparison; it shared SLRE usage and XML configuration traits and was distributed through the same botnets as Dridex.
Banking trojan used by TA505 in campaigns targeting Japan and the UK; delivered via macro-enabled Office document attachments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.