Trusted Design

An Update on the UrlZone Banker

概要

UrlZone is a banking trojan that appeared in 2009. Searching its name or one of its aliases (Bebloh or Shiotob) reveals a good deal of press from that time period along with a few technical analyses in 2009 [1] [2], 2012 [3], and 2013 [4]. Despite having a reputation of evolution, there doesn’t seem to be very many recent updates on this malware family though. Is UrlZone still a threat and if so, how has it changed?

Created: 2026-02-23

Indicators

• domain - anptlnadkpkhmc3.net -
• domain - lfaf9nqo49k9yz.com -
• domain - 1uer3u9vttynxg.com -
• FileHash-MD5 - 01fd0f1ad59ad5403c9507bfb625fe0c -
• domain - dwc5cbjada.net -
• domain - zjz45p43xkw1rxa.net -
• domain - pb9r9w5bk5bipws.com -
• domain - 9eiic393tze3nmx.com -
• URL - anptlnadkpkhmc3.net/gnu/ -
• URL - ebfszfmcg325fnr.net/gnu/ -
• FileHash-SHA256 - b91268172937a4adc04e2988efa2e47c8608815091f6c356200fc3e369516229 -
• domain - ysg9ivv311.com -
• domain - 14mdbbx3242lm5q.net -
• domain - led3dddga4xgj44.com -
• domain - 5bizcsfozjtsony.com -
• domain - amp45rhstc3b9a3.net -
• FileHash-SHA256 - 39bbde33922cd6366d7c2a252c4aadd4dfd7405d5271e3652940a7494b885e88 -
• domain - 59njm3tgtwggfu3.com -
• domain - lvzyjwj1fakh55i.com -
• domain - szhtdp1scvhbnu9.net -
• domain - xqxcysbkjadwpx.net -
• domain - oxda13oess.com -
• domain - ebfszfmcg325fnr.net -
• domain - 1vp412e12nheix.net -

類似Pulses

• Updated Blackmoon banking Trojan (score: 0.61)
• PROOFPOINT 2016-02-05: Vawtrak and UrlZone Banking Trojans (score: 0.61)
• BEBLOH Expands to Japan in Latest Spam Attack (score: 0.57)
• Shifu: New Banking Trojan Is Attacking 14 Japanese Banks (score: 0.56)
• The Curious Case of an Unknown Trojan Targeting German-Speaking Users (score: 0.56)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る