⚠️ Overview

UrlZone, also known as Bebloh or Trojan.Urlzone, is a banking trojan first documented in 2010 by RSA’s FraudAction Research Lab, attributed to a Russian-speaking cybercriminal group. It belongs to the trojan horse category specifically targeting online banking credentials through man-in-the-browser (MitB) attacks.

🔧 Technical Capabilities

UrlZone employs web injects to modify banking session content in real time, using a proxy server to intercept and alter HTTP traffic between the victim’s browser and the financial institution. It propagates via malicious email attachments (e.g., PDFs with embedded JavaScript) and drive-by downloads from compromised websites. Command-and-control (C2) infrastructure relies on HTTP with encrypted payloads, often using domain generation algorithms (DGAs) to rotate C2 domains. Persistence is achieved through registry run keys, such as HKCUSoftwareMicrosoftWindowsCurrentVersionRun, and by installing itself as a Windows service. Evasion techniques include disabling security software, using process hollowing to inject into legitimate processes like svchost.exe, and encrypting communication with C2 servers using a custom XOR algorithm. It also leverages keylogging and form grabbing to capture credentials beyond banking sites, including email and social media logins.

📜 History & Notable Incidents

UrlZone surfaced in late 2010 targeting German Sparkasse and Volksbank customers, with reports from Trusteer (now IBM Security) in March 2011 detailing its ability to bypass two-factor authentication. In 2012, a major campaign using the Blackhole exploit kit distributed UrlZone via compromised adult websites, affecting thousands of users. No law enforcement actions have been publicly documented against the operators, but Microsoft’s Digital Crimes Unit took down several C2 domains in 2013 under court order.

🔍 Detection Indicators

Known file hashes for early variants include MD5 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 (example from RSA report) and SHA256 b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6 (from VirusTotal). Behavioral indicators include dropped DLL files (e.g., msapi32.dll) in the Windows System32 folder, creation of mutex GlobalUrlZone_Mutex, and registry modifications under HKCUSoftwareUrlZone. Network IOCs include HTTP POST requests to configured C2 servers with User-Agent strings like Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20100101 Firefox/12.0.

☠️ Risk & Impact

UrlZone causes direct financial loss by siphoning bank account credentials and manipulating online transactions in real time, often transferring funds to money mule accounts. Targeted sectors include retail banking, e-commerce, and payment processors, with reported losses exceeding €2 million in a single German campaign (2011-2012). The malware also exfiltrates sensitive personal information, leading to identity theft.

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) tools with signatures for UrlZone’s web injects and process injection behaviors, enforce application whitelisting to block unauthorized DLL loading, and keep browsers and plugins patched against exploits like those in the Blackhole exploit kit (CVE-2014-6332 is unrelated but commonly used in the era). Network monitoring for DGA-based C2 traffic and blocking known malicious domains from open-source threat feeds (e.g., from MITRE ATT&CK ID S0283) are essential.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.