TSPY_DYRE.XMS

This spyware may be downloaded by other malware/grayware/spyware from remote sites.

It connects to certain websites to send and receive information. It deletes itself after execution.

Arrival Details

This spyware may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This spyware drops the following files depending on the platform/operating system of the affected computer:

• %System%\config\systemprofile\Application Data\ne9bzef6m8.dll (for Windows XP and lower)
• %AppDataLocal%\ne9bzef6m8.dlll (for Windows Vista and higher)

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system and executes them:

• %Windows%\{random filename}.exe (for Windows XP and lower)
• %AppDataLocal%\{random filename}.exe (for Windows Vista and higher)

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects codes into the following process(es):

• explorer.exe
• svchost.exe

Autostart Technique

This spyware registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate
Type = "10" (For Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate
Start = "2" (For Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate
ErrorControl = "1" (For Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate
ImagePath = "%Windows%\{random filename}.exe" (For Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate
DisplayName = "Update Service" (For Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate
ObjectName = "LocalSystem" (For Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate\Security
Security = "{hex values}" (For Windows XP and below)

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
GoogleUpdate = "%AppDataLocal%\{random filename}.exe" (For Windows Vista and above)

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate (for Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\googleupdate\Security (For Windows XP and below)

Information Theft

This spyware gathers the following data:

• Host Name
• Public IP Address
• OS Version
• User Name
• Computer Name
• OS platform
• Installed programs

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• google.com
• microsoft.com

It connects to the following URL(s) to get the affected system's IP address:

• http://icanhazip.com

It connects to the following website to send and receive information:

• {BLOCKED}.{BLOCKED}.138.75:443
• {BLOCKED}.{BLOCKED}.97.54:443
• {BLOCKED}.{BLOCKED}.53.23:443
• {BLOCKED}.{BLOCKED}.213.153:443
• {BLOCKED}.{BLOCKED}.220.102:4443
• {BLOCKED}.{BLOCKED}.249.18:443
• {BLOCKED}.{BLOCKED}.174.234:443
• {BLOCKED}.{BLOCKED}.235.251:443
• {BLOCKED}.{BLOCKED}.65.224:4443
• {BLOCKED}.{BLOCKED}.131.104:4443
• {BLOCKED}.{BLOCKED}.88.150:443
• {BLOCKED}.{BLOCKED}.97.45:443
• {BLOCKED}.{BLOCKED}.122.31:443
• {BLOCKED}.{BLOCKED}.121.140:443
• {BLOCKED}.{BLOCKED}.181.148:4443
• {BLOCKED}.{BLOCKED}.19.156:443
• {BLOCKED}.{BLOCKED}.104.250:443
• {BLOCKED}.{BLOCKED}.73.59:4443
• {BLOCKED}.{BLOCKED}.38.6:4443
• {BLOCKED}.{BLOCKED}.239.98:4443
• {BLOCKED}.{BLOCKED}.206.42:4443
• {BLOCKED}.{BLOCKED}.53.23:443
• {BLOCKED}.{BLOCKED}.191.70:443
• {BLOCKED}.{BLOCKED}.189.92:443
• {BLOCKED}.{BLOCKED}.139.42:4443
• {BLOCKED}.{BLOCKED}.191.222:443
• {BLOCKED}.{BLOCKED}.181.148:4443
• {BLOCKED}.{BLOCKED}.69.138:4443
• {BLOCKED}.{BLOCKED}.139.42:4443
• {BLOCKED}.{BLOCKED}.69.130:443
• {BLOCKED}.{BLOCKED}.177.98:443
• {BLOCKED}.{BLOCKED}.191.222:443
• {BLOCKED}.{BLOCKED}.177.126:443
• {BLOCKED}.{BLOCKED}.249.122:443
• {BLOCKED}.{BLOCKED}.216.5:4443
• {BLOCKED}.{BLOCKED}.206.42:4443
• {BLOCKED}.{BLOCKED}.191.70:443
• {BLOCKED}.{BLOCKED}.255.64:443
• {BLOCKED}.{BLOCKED}.65.224:4443
• {BLOCKED}.{BLOCKED}.88.150:443
• {BLOCKED}.{BLOCKED}.1.195:443
• {BLOCKED}.{BLOCKED}.230.117:443
• {BLOCKED}.{BLOCKED}.206.42:4443
• {BLOCKED}.{BLOCKED}.70.129:443
• {BLOCKED}.{BLOCKED}.77.203:443
• {BLOCKED}.{BLOCKED}.172.200:443
• {BLOCKED}.{BLOCKED}.170.188:443
• {BLOCKED}.{BLOCKED}.177.99:443
• {BLOCKED}.{BLOCKED}.97.66:443
• {BLOCKED}.{BLOCKED}.223.146:4443
• {BLOCKED}.{BLOCKED}.91.127:4443
• {BLOCKED}.{BLOCKED}.204.3:4443
• {BLOCKED}.{BLOCKED}.255.199:4443
• {BLOCKED}.{BLOCKED}.61.144:443
• {BLOCKED}.{BLOCKED}.80.111:443
• {BLOCKED}.{BLOCKED}.169.161:443
• {BLOCKED}.{BLOCKED}.19.156:443
• {BLOCKED}.{BLOCKED}.59.234:443
• {BLOCKED}.{BLOCKED}.149.39:4443
• {BLOCKED}.{BLOCKED}.255.199:4443
• {BLOCKED}.{BLOCKED}.214.40:4443
• {BLOCKED}.{BLOCKED}.216.5:4443
• {BLOCKED}.{BLOCKED}.48.175:443
• {BLOCKED}.{BLOCKED}.2.165:443

It deletes itself after execution.

NOTES:

It monitors the following browsers:

• chrome.exe
• firefox.exe
• iexplore.exe

It also connects to generated domain names to send and receive information:

• {Generated domain name}.so
• {Generated domain name}.tk
• {Generated domain name}.cn
• {Generated domain name}.hk
• {Generated domain name}.in
• {Generated domain name}.to
• {Generated domain name}.ws
• {Generated domain name}.cc

This spyware connects to the following STUN (Session Traversal Utilities for NAT) server in order to determine the public IP address of the compromised computer:

• stun1.voiceeclipse.net
• stun.callwithus.com
• stun.sipgate.net
• stun.ekiga.net
• stun.internetcalls.com
• stun.noc.ams-ix.net
• stun.voip.aebc.com
• stun.voipbuster.com
• stun.voxgratia.org
• stun.ipshka.com
• stun.faktortel.com.au
• stun.iptel.org
• stun.voipstunt.com
• 203.183.172.196:3478
• s1.taraba.net
• stun.l.google.com:19302
• stun1.l.google.com:19302
• stun2.l.google.com:19302
• stun3.l.google.com:19302
• stun4.l.google.com:19302
• stun.schlund.de
• stun.rixtelecom.se
• stun.voiparound.com
• numb.viagenie.ca
• stun.stunprotocol.org
• stun.services.mozilla.com
• stun.2talk.co.nz

The malware can also do the following:

• Receive configuration(web injects)
• Receive New connections
• Download file and execute
• Download Module(VNC,TV)
• Browser Snapshot
• Shutdown/restart system

This spyware monitors the following banks/financial institutions:

• abconline.arabbanking.com
• accesd.affaires.desjardins.com
• access.jpmorgan.com
• access.usbank.com
• achieveaccess.charterone.com
• admin.epymtservice.com
• afactorcontact.com
• aibinternetbanking.aib.ie
• akp.aab.de
• alolb1.arbuthnotlatham.co.uk
• ambank.amonline.com.my
• an.rbcnetbank.com
• ap.ebs.bankofchina.com
• apps.bhw.de
• apps.virginmoney.com
• at-directnet.credit-suisse.com
• au-services.credit-suisse.com
• auth.globalpay.westernunion.com
• aw.rbcnetbank.com
• bancodicaribeonline.com
• bank.barclays.co.uk
• bank.ruralbank.com.au
• banking.bankhaus-mayer.de
• banking.bankofscotland.co.uk
• banking.bankofscotland.de
• banking.beyondbank.com.au
• banking.bmwbank.de
• banking.bw-bank.de
• banking.commerzfinanz.com
• banking.degussa-bank.de
• banking.donner-reuschel.de
• banking.ing-diba.at
• banking.ing-diba.de
• banking.ireland-bank.com
• banking.lloydsbank.com
• banking.martinbank.de
• banking.nfbank.de
• banking.oberbank.de
• banking.oyakankerbank.de
• banking.postbank.de
• banking.secure.bnl.it
• banking.smile.co.uk
• banking.steylerbank.de
• banking.triodos.co.uk
• banking.unionbank.de
• banking.valovisbank.de
• banking.varengold.de
• bankinguk.secure.investec.com
• bankofirelandlifeonline.ie
• bankonline.sboff.com
• bankonweb.sgeb.bg
• banque.bfcoi.com
• banques.exalog.net
• basfnet.france.banqueaudi.com
• bbmy.ocbc.com
• bbonline.bankofmelbourne.com.au
• bbonline.banksa.com.au
• bbonline.stgeorge.com.au
• bizpermonline.newcastlepermanent.com.au
• blcweb.banquelaurentienne.ca
• bol.westpac.co.nz
• bolpp.bankofireland.com
• bourse.cholet-dupont.fr
• boursebesv.besv.fr
• br.credit-suisse.com
• bs-services.credit-suisse.com
• btultra.btrl.ro
• bureau.bottomline.co.uk
• business-eb.ibanking-services.com
• business.co-operativebank.co.uk
• business.firstcitizensonline.com
• business.santander.co.uk
• business2.danskebank.co.uk
• business2.danskebank.com
• business2.danskebank.dk
• business2.danskebank.ie
• business2.danskebank.no
• businessaccess.citibank.citigroup.com
• businessbank.tsbbank.co.nz
• businessbanking.tdcommercialbanking.com
• businesscenter.mysynchrony.com
• businessonline.huntington.com
• businessonline.mutualofomahabank.com
• businessonline.tdbank.com
• businessonline.westpac.com.au
• butterfieldonline.co.uk
• cardonebanking.com
• casextern.creditplus.de
• cashmanagement.barclays.net
• cashmanager.mizuhoe-treasurer.com
• cashproonline.bankofamerica.com
• catalystcorp.org
• cbfm.saas.cashfac.com
• cbionline.cbi.ae
• cfi.mb.seb.se
• cgacontact.c-g-a.fr
• cgaetoile.c-g-a.fr
• cgaoi.c-g-a.fr
• cgi-hp.espace-clients.fr
• charisma.btdirect.ro
• cib.affinonline.com
• cib.bankofthewest.com
• cib.icicibank.com
• cib.uab.ae
• cityntl.webcashmgmt.com
• classic.nordea.fi
• client.gemoneybank.fr
• clientlogin.ibb.ubs.com
• clientpoint.fisglobal.com
• clientportal.ibb.ubs.com
• clients.banque-fiducial.fr
• clients.tilneybestinvest.co.uk
• clientview-mx.credit-suisse.com
• cmbdirect.cmbnv.com
• cmo.cibc.com
• cmol.bbt.com
• commerceconnections.commercebank.com
• commercial.bnc.ca
• connect-ch2.ubs.com
• connect.bnymellon.com
• connexis.bnpparibas.com
• corporate.adcb.com
• corporate.metrobankonline.co.uk
• cpn.hsbc.com.mx
• cs.directnet.com
• db-direct.db.com
• db-sg.db.com
• direct.capitecbank.co.za
• direct.mcbgroup-ebanking.com
• drob.santanderbank.com
• e-access.compassbank.com
• e-bank.unicreditbank.si
• e-bank.wuestenrot.de
• e-cash.alrajhibank.com.my
• eadibcorp.adib.ae
• eastwestbank.webcashmgmt.com
• ebaer.juliusbaer.com
• ebank.garantibank.nl
• ebank.publicbank.com.hk
• ebank.turkishbank.co.uk
• ebankas.danskebank.lt
• ebanking-au.ubs.com
• ebanking-aut.ubs.com
• ebanking-bel.ubs.com
• ebanking-bhs2.ubs.com
• ebanking-ca.ubs.com
• ebanking-can.ubs.com
• ebanking-ch.ubs.com
• ebanking-ch2.ubs.com
• ebanking-de1.ubs.com
• ebanking-es.ubs.com
• ebanking-fr.ubs.com
• ebanking-hksg.ubs.com
• ebanking-it.ubs.com
• ebanking-lux.ubs.com
• ebanking-mc.ubs.com
• ebanking-nld.ubs.com
• ebanking-uk.ubs.com
• ebanking.fransabank.com
• ebanking.procreditbank-kos.com
• ebanking.societegenerale.al
• ebanking.societegenerale.in
• ebanking2.danskebank.co.uk
• ematchingnz1.online.anz.com
• enlace.santander-serfin.com
• enthimag34581.com
• entreprises.bnpparibas.net
• entreprises.societegenerale.fr
• epayday.e-ambiz.com.my
• eplusgiro.plusgirot.se
• es-services.credit-suisse.com
• esavings.shawbrook.co.uk
• esecure.banque-edel.fr
• esipub.esi-sa.com
• espace-client.cora.fr
• express.53.com
• extra.unicreditbank.hu
• fareastnationalbank.ebanking-services.com
• fastbanking.bancpost.ro
• fastpay.asbbank.co.nz
• fdonline.co-operativebank.co.uk
• ffcw.webcashmgmt.com
• financepilot-pe.mlp.de
• finanzportal.fiducia.de
• fnfgbusinessonline.enterprisebanker.com
• fr-services.credit-suisse.com
• fx.regions.com
• fxpayments.americanexpress.com
• gfs.nb.se
• gg-services.credit-suisse.com
• gi-services.credit-suisse.com
• girolink.plusgirot.se
• girovision.plusgirot.se
• global.kbstar.com
• globalpay.westernunion.com
• group.unicreditbanking.net
• hbciweb.olb.de
• hk-services.credit-suisse.com
• home1.ybonline.co.uk
• home2.cybusinessonline.co.uk
• homebank.tsbbank.co.nz
• ht.businessonlinepayroll.com
• ib.absa.co.za
• ib.banksyd.com.au
• ib.btrl.ro
• ib.mebank.com.au
• ib.tmbank.com.au
• ibank.gtbankuk.com
• ibank.reliancebankltd.com
• ibank.sbs.net.nz
• ibank.standardchartered.com.sg
• ibank.theaccessbankukltd.co.uk
• ibank.zenith-bank.co.uk
• ibank1.bib.barclays.com
• ibanking.bankofmelbourne.com.au
• ibb.firsttrustbank1.co.uk
• ibs.bankwest.com.au
• ibs.medbank.lt
• ideal.dbs.com
• inba.lukb.ch
• inbursamf.inbursa.com
• inetbnkp.adelaidebank.com.au
• infinity.icicibank.co.uk
• internationalfx.bannerbank.com
• internet-banking.dbs.com.sg
• internet.ocbc.com
• internetbanken.privat.nordea.se
• internetbanking.firstcaribbeanbank.com
• internetbanking.imb.com.au
• internetbanking.scu.net.au
• internetbanking.suncorpbank.com.au
• invest.etrade.com.au
• it-services.credit-suisse.com
• itreasury.regions.com
• jpmcsso-uk.jpmorgan.com
• jpmcsso.jpmorgan.com
• jpmorgan.chase.com
• jpmpb001.jpmorgan.com
• konto.baaderbank.de
• ktt.key.com
• kunde.comdirect.de
• kunde.onvista-bank.de
• kunden-mkb-bank.de
• leumionline.bankleumi.co.uk
• leumionline.leumiusa.com
• live.barcap.com
• lloydslink.online.lloydsbank.com
• login.24banking.ro
• login.isso.db.com
• login.salesforce.com
• login.smartbusiness.ae
• logon.online.anz.com
• logon.reflex.rhbbank.com.my
• logon.rhb.com.my
• lu-directnet.credit-suisse.com
• mc-services.credit-suisse.com
• mcbdirect.mcb-bank.com
• mcbdirect.mcbbonaire.com
• mdcommercial.jpmorgan.com
• meine.deutsche-bank.de
• meine.sutorbank.de
• mijn.ing.nl
• my.banklenz.de
• my.hsbcprivatebank.com
• my.hypovereinsbank.de
• my.sjpbank.co.uk
• my.statestreet.com
• myaccounts.newbury.co.uk
• mybbsaccounts.bucksbs.co.uk
• nab.directnet.com
• nabconnect*.nab.com.au
• nb.nordea.no
• nebasilicon.fdecs.com
• net.crediteurope.ro
• netaccess3.qtmb.com.au
• netbanking.mashreqbank.com
• netbanking.ubluk.com
• nettbanken.nordea.no
• netteller*.pnbank.com.au
• netteller2.tsw.com.au
• nge01.bnymellon.com
• obank.kbstar.com
• online-business.bankofscotland.co.uk
• online-business.tsb.co.uk
• online-private.unicredit.it
• online-retail.unicredit.it
• online-smallbusiness.unicredit.it
• online.adambank.com
• online.akbank.de
• online.alrayanbank.co.uk
• online.bankmecu.com.au
• online.bankofcyprus.co.uk
• online.bankofscotland.co.uk
• online.bulbank.bg
• online.ccbank.co.uk
• online.citi.eu
• online.corp.westpac.com.au
• online.coutts.com
• online.dib.ae
• online.duncanlawrie.com
• online.ebs.ie
• online.hbs.net.au
• online.hl.co.uk
• online.hoaresbank.co.uk
• online.kbc.ie
• online.lloydsbank.co.uk
• online.multiport.com.au
• online.mystate.com.au
• online.nbad.com
• online.privatebanking.societegenerale.be
• online.unicreditcorporate.it
• online.westpac.com.au
• online.ybs.co.uk
• onlinebanking-sg.credit-suisse.com
• onlinebanking.bankcoop.ch
• onlinebanking.coutts.com
• onlinebanking.orcobank.com
• onlinebusiness.lloydsbank.co.uk
• onlinebusinessplus.vancity.com
• onlineservices.ubs.com
• particuliers.societegenerale.fr
• pbusa.directnet.com
• personal.co-operativebank.co.uk
• personal.gironet.com
• personeo.epargne-retraite-entreprises.bnpparibas.com
• pfo.us.hsbc.com
• portal.berenberg.de
• portal.northonline.com.au
• portal.sutorbank.de
• portal4.sydbank.dk
• private.bankofsingapore.com
• privatebank-us.ubs.com
• pro.skb.net
• probank.tsbbank.co.nz
• probanking.procreditbank.ba
• professionnels.societegenerale.fr
• rakbankonline.ae
• retail.santander.co.uk
• rib.affinonline.com
• ribs.rabobank.com.au
• ro.unicreditbanking.net
• s2b.standardchartered.com
• santander.hpdsc.com
• sec.westpac.co.nz
• secure.aldermorebusinesssavings.co.uk
• secure.ampbanking.com
• secure.anz.co.nz
• secure.boqspecialist.com.au
• secure.defencebank.com.au
• secure.handelsbanken.com
• secure.heartland.co.nz
• secure.ingdirect.it
• secure.internetbanking.firstcaribbeanbank.com
• secure.internetbanking.ro
• secure.macquarie.com.au
• secure.membersaccounts.com
• secure.moneyou.de
• secure.tddirectinvesting.co.uk
• secure.unicreditbank.lu
• secure1.businesswaybnl.it
• secure1.entreprises.bnpparibas.net
• secure1.rabodirect.co.nz
• secure2.alphabank.ro
• securebank.santander.de
• securebanking.hanseaticbank.de
• securentrycorp.amegybank.com
• securentrycorp.calbanktrust.com
• securentrycorp.nsbank.com
• securentrycorp.zionsbank.com
• secureprivateebanking.nordea.ch
• secureprivateebanking.nordea.lu
• secureprivateebanking.nordea.sg
• securitiesexpert.credit-suisse.com
• see.sbi.com.mx
• sg.bibplus.uobgroup.com
• sgcib.pl
• sharinbox.societegenerale.com
• si.unicreditbanking.net
• sikanet.sg-ssb.com.gh
• singlepoint.usbank.com
• sites.scotiabank.com.mx
• sogecashnet.sga.dz
• sogecashnet.societegenerale.cg
• sogeonline.societegenerale.cn
• solo.nordea.com
• solo1.nordea.fi
• solo3.nordea.fi
• spaokrjo19281.com
• spib.wooribank.com
• sponsor.voya.com
• sslsecure.maybank.com.sg
• ssologin.bnpparibas.com
• subastas.scotiainlatrade.com
• tb.raiffeisendirect.ch
• tdetreasury.tdbank.com
• tdwealth.netxinvestor.com
• ticari.yapikredi.com.tr
• top.capitalonebank.com
• transactgateway.svb.com
• transtasman.online.anz.com
• trz.tranzact.org
• u-2-view.chorleybs.co.uk
• ufo.union-investment.de
• uk.hkbea-cyberbanking.com
• uksecure.barclayswealth.com
• unified-access.societegenerale.com
• uniservices2.uobgroup.com
• usgateway*.rbs.com
• velocity.ocbc.com
• verkkopankki2.danskebank.fi
• wealth.goldman.com
• wealthclient.closebrothers.com
• web.procapital.fr
• webbanking.bgl.lu
• webcmpr.bancopopular.com
• webzr.aktivbank.de
• wellsoffice.wellsfargo.com
• wertpapier.hafnerbank.de
• wibdirect.wib-bank.net
• www*.my.commbiz.commbank.com.au
• www.365online.com
• www.accessonline.abnamro.com
• www.alliancebizsmart.com.my
• www.anz.com
• www.anzdirect.co.nz
• www.anztransactive.anz.com
• www.arabi-online.net
• www.asbolb.com
• www.asl.com
• www.bami.lmpatrimonline.com
• www.bamibanque.fr
• www.bancaempresarialazteca.com.mx
• www.bancoinbursa.com
• www.bancorpsouthinview.web-cashplus.com
• www.bancorpsouthonline.com
• www.bankdirect.co.nz
• www.bankhaus-lampe.de
• www.banking.axa.de
• www.bankline.natwest.com
• www.bankline.rbs.com
• www.bankline.ulsterbank.ie
• www.banorte.com
• www.banque-tahiti.pf
• www.barclayswealth.com
• www.bcif.fr
• www.bcv.ch
• www.bendigobank.com.au
• www.benefitaccess.com
• www.bizchannel.cimb.com.sg
• www.bnpparibasfortis.be
• www.bnz.co.nz
• www.boi-bol.com
• www.bostonprivatebank.com
• www.brdoffice.ro
• www.business.hsbc.co.uk
• www.bybloseuropeonline.com
• www.byblosonline.com
• www.cardservicesdirect.com.au
• www.casden.fr
• www.cashanalyzer.com
• www.caterallenonline.co.uk
• www.ceconline.ro
• www.chase.com
• www.cimb.bizchannel.com.my
• www.citibank.com.au
• www.citibank.com.my
• www.citibank.com.sg
• www.citibusiness.citibank.com.sg
• www.citigold.com.my
• www.cmb-home.com
• www.co-operativebank.co.nz
• www.colonialfirststate.com.au
• www.commercial.hsbc.com.hk
• www.corealdirect.de
• www.corpnet.lu
• www.corporate-clients.commerzbank.com
• www.coventrybuildingsociety.co.uk
• www.credit-cooperatif.coop
• www.credit-suisse.com.sg
• www.ct6.e-i.com
• www.dab-bank.de
• www.danskebank.fi
• www.danskebank.no
• www.dbsvonline.com
• www.degussa-bank.de
• www.deutschebank-dbdirect.com
• www.dialog.bsibank.com
• www.e-ambiz.com.my
• www.e-connect.bsibank.com
• www.ebanking.hsbc.co.nz
• www.efirstbank.com
• www.epargne-entreprise.federal-finance.fr
• www.exane.com
• www.factocicpartnet.com
• www.fcsolb.com
• www.fidunet.lu
• www.fineco.it
• www.firstmerit.com
• www.firstmeritib.com
• www.flexipurchase.com
• www.fnb.co.za
• www.frostcashmanager.com
• www.gecapitalbank.com
• www.gemyaccounts.com
• www.gerrard.com
• www.goldman.com
• www.gs.reyrey.com
• www.gtb.unicredit.eu
• www.halifax-online.co.uk
• www.hongleongonline.com.my
• www.hsbc.co.uk
• www.hsbc.com.au
• www.hsbc.com.my
• www.hsbc.com.sg
• www.hsbctrinkaus.de
• www.hvbrsce.com
• www.hypotirol.com
• www.ib.boq.com.au
• www.ib.kiwibank.co.nz
• www.ing.be
• www.ing.lu
• www.ingbank.cz
• www.ingdirect.com.au
• www.ingonline.com
• www.interacciones.com
• www.internationalmoneytransfers.com.au
• www.internationalpayments.co.uk
• www.intesasanpaolo.com
• www.investbank.ae
• www.investimenti.unicredit.it
• www.iombankibanking.com
• www.kbinternetbanking.com
• www.maybank2e.com
• www.maybank2e.net
• www.maybank2u.com.my
• www.mcb-home.com
• www.mcbb-home.com
• www.mercantilcbonline.com
• www.mercedes-benz-bank.de
• www.mkbag.de
• www.ml.com
• www.my.commbank.com.au
• www.mybsn.com.my
• www.mydegroof.fr
• www.mymerrill.com
• www.natwestibanking.com
• www.netbank.nordea.dknetbankindex.jsp*
• www.noorinternetbanking.com
• www.nordeaim.nordea.com
• www.nwolb.com
• www.obsgnet.com.mk
• www.onlinebanking.iombank.com
• www.onlinebanking.natwestoffshore.com
• www.onlinesbiglobal.com
• www.open24.ie
• www.paymentnet.jpmorgan.com
• www.portail.banque-solfea.fr
• www.postfinance.ch
• www.pouyanne.net
• www.privatebanking.societegenerale.com
• www.publicmutualonline.com.my
• www.raiffeisenonline.ro
• www.rbsdigital.com
• www.rbsidigital.com
• www.rbsiibanking.com
• www.sbisyd.com.au
• www.scotiaconnect.scotiabank.com
• www.scotiaweb.com.mx
• www.secure.bnpparibas.net
• www.sft-ebanking.com
• www.sg-bdp.pf
• www.sgcb.nc
• www.signatureny.web-access.com
• www.sogecashnet.ma
• www.sogehomebank.com
• www.standardlife.co.uk
• www.superchoice.com.au
• www.superorganised.com.au
• www.svbconnect.com
• www.tmbbizdirect.com
• www.tranzact.org
• www.treasury.pncbank.com
• www.ubibanca.com
• www.ubs.com
• www.uibanking-net.com
• www.ulsterbankanytimebanking.ie
• www.unicreditbank.ba
• www.unicreditbank.cz
• www.unicreditbank.sk
• www.unity-online.co.uk
• www.us.hsbcprivatebank.com
• www.vancity.com
• www.volkswagenbank.de
• www.wib-home.com
• www.youinvest.co.uk
• www.zaba.hr
• www1.firstdirect.com
• www1.rbcbankusa.com
• www2.pbebank.com
• www2.secure.hsbcnet.com
• www22.bmo.com
• www4.banquewormser.com
• www6.rbc.com
• www8.comerica.com
• wwwsec.ebanking.zugerkb.ch
• wwwsec.valiant.ch

This malware uses SSL to secure its network traffic.