URLzone
URLzone, also known as Bebloh, is an e-banking trojan/banking trojan associated in the provided content with the Avalanche criminal infrastructure. The content states that Avalanche hosted URLzone and also provided double-fast-flux communication infrastructure for botnets including URLzone. Avalanche-linked activity targeted Microsoft Windows systems and more than 40 major financial institutions, and associated malware families were described as capable of stealing user credentials and sensitive financial data including banking and credit card information, providing unauthorized remote access, distributing additional malware, and enabling infected systems to participate in DDoS activity. Law-enforcement and industry reporting cited in the content links Bebloh/URLzone infections to German-speaking victims and notes that investigators found Bebloh and Ransomlock shared command-and-control infrastructure. Additional reporting in the content says Spamhaus identified 35 command-and-control servers associated with URLzone. Proofpoint also observed a campaign targeting Japanese users in which malicious Microsoft Excel documents dropped URLZone and ultimately led to a final Ursnif payload. High-confidence aliases in the content identify URLzone as Bebloh.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...campaign targeting Japanese users dropping URLZone from malicious Microsoft Excel documents, which eventually led to a final Ursnif payload.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesThe criminal groups have been using the Avalanche infrastructure since 2009 for conducting malware, phishing and spam activities. They sent more than 1 million e-mails with damaging attachments or links every week to unsuspecting victims.
They sent more than 1 million e-mails with damaging attachments or links every week to unsuspecting victims.
They sent more than 1 million e-mails with damaging attachments or links every week to unsuspecting victims.
Credential Access
2 techniquesMillions of private and business computer systems were also infected with malware, enabling the criminals operating the network to harvest bank and e-mail passwords.
Victims may have had their sensitive personal information stolen (e.g., user account credentials).
Collection
1 techniqueA system infected with Avalanche-associated malware may be subject to malicious activity including the theft of user credentials and other sensitive data, such as banking and credit card information.
Command and Control
3 techniquesSinkholing is an action whereby traffic between infected computers and a criminal infrastructure is redirected to servers controlled by law enforcement authorities... infected computers can no longer reach the criminal command and control computer systems and so criminals can no longer control the infected computers.
Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.
Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Payload dropped from malicious Excel documents as part of an infection chain that ultimately delivers Ursnif.
Banking trojan associated with Avalanche infrastructure.
Banking trojan associated with Avalanche infrastructure.
Banking malware family distributed via Avalanche infrastructure and associated with credential and financial data theft.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.