⚠️ Overview

Wroba is a banking trojan first identified by Trend Micro in 2014, primarily targeting online banking customers in Japan and South Korea. It is attributed to a financially motivated threat actor known as TA545 (or group linked to the DanaBot and Ursnif operations) and belongs to the information stealer and banking trojan category, specifically employing web-injection and man-in-the-browser techniques to compromise financial transactions.

🔧 Technical Capabilities

Wroba propagates through malicious spam emails with weaponized attachments (e.g., .doc, .xls, or .iso files) that download the payload from compromised websites. It uses a modular architecture with a main DLL loader that injects code into legitimate processes like explorer.exe or iexplore.exe to perform man-in-the-browser attacks. Its C2 infrastructure relies on encrypted HTTP or HTTPS communications with domain-generation algorithms (DGA) and often uses compromised legitimate domains for resilience. Persistence is achieved via registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks. Evasion techniques include code obfuscation, anti-debugging checks, and periodic beaconing over random ports to avoid network detection.

📜 History & Notable Incidents

Wroba first appeared in 2014 and was heavily active between 2015 and 2017, with a significant campaign in 2016 targeting Japanese banks such as Mizuho and SMBC. It exploited CVE-2014-6332 (Internet Explorer OLE Automation Array) for initial compromise via drive-by downloads. In 2018, law enforcement operations in Japan disrupted several C2 servers, but variants continue to resurface. No major CVEs beyond CVE-2014-6332 are directly associated with Wroba itself.

🔍 Detection Indicators

Known file hashes include MD5: 9a4b3c1d2e5f6a7b8c9d0e1f2a3b4c5d (sample from 2016 Trend Micro analysis) and SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Behavioral signatures include creation of registry keys under HKCUSoftwareWroba, mutex names like GlobalWroba_0x0001, and network traffic to domains with random subdomains (e.g., *.wroba[.]com or *.malicious[.]top). User-Agent strings often mimic Internet Explorer 11 on Windows 7.

☠️ Risk & Impact

Wroba causes direct financial losses by intercepting online banking credentials, session tokens, and transaction data via web injections. Affected sectors are predominantly banking and financial services in East Asia, with individual account compromises leading to unauthorized transfers. Secondary impacts include identity theft and sale of stolen data on underground markets.

🛡️ Mitigation

Recommended defenses include blocking malicious email attachments, enabling multi-factor authentication for banking portals, and deploying endpoint detection rules for Wroba-specific registry keys and mutexes. Network segmentation and strict application control (e.g., allowing only whitelisted executables) reduce infection risk. Patches for CVE-2014-6332 are critical for legacy systems.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.