Loading malware…
URLZone, also known as Bebloh and Shiotob, is a Windows banking Trojan first observed in 2009 and widely characterized as a man-in-the-browser malware family. It is designed to target online banking activity by intercepting browser and network communications, applying webinject-style fraud logic, stealing credentials and financial data, and concealing unauthorized transactions from victims. The malware has historically maintained a relatively selective targeting model focused on specific financial institutions, including campaigns against banks in Japan and Spain, and has also been associated with broader online banking fraud activity affecting German-speaking victims.
Technically, URLZone uses process injection and API hooking to embed itself into browser and system processes and manipulate web sessions. Reported behavior includes injecting into processes such as Internet Explorer and other Windows processes, sharing state across injected components, storing encrypted configuration data, and maintaining persistence through registry-based mechanisms including Image File Execution Options abuse. It communicates with centralized command-and-control infrastructure, retrieves configuration updates and malware updates, and uses encrypted or encoded communications. Its configuration can contain targeted institution definitions, request masks, HTML injection templates, and fraud logic used to alter inbound and outbound traffic during banking sessions.
URLZone has been observed monitoring or interacting with multiple applications beyond web browsers, including email clients and FTP clients, and hooking networking libraries to intercept and modify traffic. Its webinject capability has been used to steal login credentials, PINs, and one-time passwords. In some campaigns, URLZone served as an initial payload that subsequently downloaded and installed Ursnif, particularly in Japan-focused operations. Delivery has included large-scale spam campaigns, often using malicious Office documents with macros or compressed executable attachments, with localized lures such as invoice or payment themes. Activity involving URLZone has been linked to the financially motivated threat actor TA544, especially in campaigns targeting Japan and Italy.
URLZone has also been tied to the Avalanche criminal infrastructure, which hosted or supported communications for numerous malware families. This association reflects its role within a broader cybercrime ecosystem centered on phishing, spam distribution, banking fraud, and resilient fast-flux-enabled command-and-control operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Messages from these campaigns drop their payloads via Microsoft Excel documents with macros, that when enabled, download URLZone (another banking Trojan), which, in turn, download Ursnif 1000.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The UrlZone banking Trojan is spreading via email spam... On January 21st of this year, Proofpoint researchers observed a large spam campaign consisting of tens of thousands of emails targeting Japanese email accounts. Emails with the subject “copy 3” from multiple Gmail accounts contained a zipped executables and an empty email body.
It may be delivered via password-protected Zip files; Microsoft Office document attachments with malicious macros; or compressed JScript, JavaScripts, or Visual Basic scripts.
Examples of recent language and locale checks include: PowerShell error for non-existent command contains "用語 " ... PowerShell cmdlet: 'Get-date' ... PowerShell cmdlet: 'Get-Culture."LCID"' needs to contain "04"
If the flag is ‘RX’, it means the environment supports VBScript... it uses {3F4DACA4-160D-11D2-A8E9-00104B365C9F} as rclsid and {3F4DACB0-160D-11D2-A8E9-00104B365C9F} as riid to get the IRegExp2 interface pointer for the vbscript check.
Both banking Trojans are using the same dynamic injects system that allows them to manipulate a financial institution’s website content. This means that the two banking Trojans use the same JavaScript code for stealing login credentials, PINs, one-time-passwords, etc.
Its data-sharing mechanism is enabled by implementing the memory-mapped files that the system paging file stores... At first, it calls CreateFileMapping with INVALID_HANDLE_VALUE as hFile and a hard-coded name... The bigger view is the container of the configuration file; the other is the storage for the C&C response.
Before it calls CreateRemoteThread to run the injected code, it inserts an argument into the memory space of the targeted process... | If the OS is 64-bit, it creates the process: %ProgramFiles%\Internet Explorer\iexplore.exe, then injects it... it calls DuplicateHandle to duplicate the handle to the current process and then injects the malicious code into csrss.exe... Before it calls CreateRemoteThread to run the injected code...
To make it secure, the plain text message will go through a sequence of encoding... At first, the plain text message will be encoded by base64... Finally, a well-known block cipher algorithm called XXTEA is used to add one more encryption layer... the configuration file is encrypted using XXTEA... stored under the registry key... encrypted using XOR with a hard-coded key and two modifiers.
One notable characteristic of TA544 is their use of steganography, which is the process of concealing code within images.
Before it calls CreateRemoteThread to run the injected code, it inserts an argument into the memory space of the targeted process... | If the OS is 64-bit, it creates the process: %ProgramFiles%\Internet Explorer\iexplore.exe, then injects it... it calls DuplicateHandle to duplicate the handle to the current process and then injects the malicious code into csrss.exe... Before it calls CreateRemoteThread to run the injected code...
Both banking Trojans are using the same dynamic injects system... use the same JavaScript code for stealing login credentials, PINs, one-time-passwords, etc.
Most Ursnif 1000 campaigns use a robust combination of geofencing techniques to verify that users are located in Japan.
A system infected with Avalanche-associated malware may be subject to malicious activity including the theft of user credentials and other sensitive data, such as banking and credit card information.
Both banking Trojans are using the same dynamic injects system... use the same JavaScript code for stealing login credentials, PINs, one-time-passwords, etc.
The focus of this bot is to steal money from targeted financial institutions and hide the transactions from the victim... This configuration file contains the URLs of the targeted financial institution, request mask templates, HTML injecting templates and other information that is used by the hooked APIs to make fraudulent transactions and create fake transaction logs.
Sinkholing is an action whereby traffic between infected computers and a criminal infrastructure is redirected to servers controlled by law enforcement authorities... infected computers can no longer reach the criminal command and control computer systems and so criminals can no longer control the infected computers.
The subroutine injected into svchost.exe is responsible for the communication between the victim’s PC and the C&C server... It sends an initial message to the C&C servers in its hard-coded list... If the response is ‘>UD [update file URL]’, it will update itself with the new file...
Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.
The hooked subroutine contains the core functions for masking domain URLs, modifying received messages and altering sending messages... InternetReadFile have the ability to filter out or alter the received data... HttpSendRequestA, modify the sending message according to the configuration file.
28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Banking trojan used by TA544 especially in Japan, commonly as an intermediate payload that downloads Ursnif 1000.
Banking trojan used heavily in Japan-targeted email campaigns. Delivered via malicious Excel macros, it performs locale/language checks to verify Japanese targets and then downloads Ursnif as a follow-on payload.
Banking malware mentioned as background context for prior attacks in Japan.
Payload dropped from malicious Excel documents as part of an infection chain that ultimately delivers Ursnif.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.