Dyre (15e969e6-f031-4441-a49b-f401332e4b00)

Dyre is a banking trojan distributed via exploit kits and malspam emails primarily. It has a modular architectur and utilizes man-in-the-browser functionality. It also leverages a backconnect server that allows threat actors to connect to a bank website through the victim's computer.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Dyre (15e969e6-f031-4441-a49b-f401332e4b00)	Banker	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	1
Dyre (15e969e6-f031-4441-a49b-f401332e4b00)	Banker	Dyre (1ecbcd20-f238-47ef-874b-08ef93266395)	Malpedia	1
System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104)	Attack Pattern	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32)	Attack Pattern	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	2
Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c)	Attack Pattern	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	2
Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9)	Attack Pattern	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	System Service Discovery - T1007 (322bad5a-1c49-4d23-ab79-76d641794afa)	Attack Pattern	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	2
Software Discovery - T1518 (e3b6daca-e963-4a69-aee6-ed4fd653ad58)	Attack Pattern	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	2
Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0)	Attack Pattern	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	Exfiltration Over C2 Channel - T1041 (92d7da27-2d91-488e-a00c-059dc162766d)	Attack Pattern	2
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	2
Software Packing - T1027.002 (deb98323-e13f-4b0c-8d94-175379069062)	Attack Pattern	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	2
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	2
Dyre - S0024 (63c2a130-8a5b-452f-ad96-07cf0af12ffe)	Malware	Dyre (1ecbcd20-f238-47ef-874b-08ef93266395)	Malpedia	2
Create or Modify System Process - T1543 (106c0cf6-bf73-4601-9aa8-0945c2715ec5)	Attack Pattern	Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32)	Attack Pattern	3
Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c)	Attack Pattern	Data Staged - T1074 (7dd95ff6-712e-4056-9626-312ea4ab4c5e)	Attack Pattern	3
Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9)	Attack Pattern	Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9)	Attack Pattern	3
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6)	Attack Pattern	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	3
Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	3
Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d)	Attack Pattern	System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	3
Software Packing - T1027.002 (deb98323-e13f-4b0c-8d94-175379069062)	Attack Pattern	Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	3