Trusted Design

Dyre Malware Campaigners Innovate with Distribution Techniques

概要

This week, Proofpoint researchers observed the now infamous “man-in-the-browser” (MITB) banking malware Dyre experimenting with new ways to deliver spam attachments. These innovations included two significant changes in Dyre behavior: Dyre employed the spambot Gophe to send thousands of randomized documents (hashes and file names) per spam campaign The spammed attachments are using a RTF trick (or a feature of Windows OS) that allows dropping an executable – but not running it – simply by opening the RTF document

Created: 2026-02-23

Indicators

• URL - https://208.117.68.78/limto1.tar -
• URL - https://78.72.233.105/limto1.tar -
• URL - https://203.129.197.50/limto1.tar -
• URL - https://67.222.201.61/limto1.tar -
• URL - https://87.126.65.67/limto1.tar -
• URL - https://109.199.11.51/limto1.tar -
• URL - https://173.216.247.74/limto1.tar -
• URL - https://82.115.76.211/limto1.tar -
• URL - https://213.92.138.154/limto1.tar -
• URL - https://201.217.51.92/limto1.tar -
• URL - https://201.217.56.83/limto1.tar -
• URL - https://188.167.93.231/limto1.tar -
• URL - https://87.97.168.205/limto1.tar -
• URL - https://27.109.20.53/limto1.tar -
• URL - https://94.40.82.66/limto1.tar -
• URL - https://62.233.252.207/limto1.tar -
• URL - https://50.24.13.21/limto1.tar -
• URL - https://93.115.172.232/limto1.tar -
• URL - https://150.129.49.11/limto1.tar -
• URL - https://93.103.20.189/limto1.tar -
• URL - https://202.70.89.57/limto1.tar -
• FileHash-SHA256 - 94ecc7d1f0fa098975a0984e55ba77ec93719b56dc3157d36311e18c51d581dc -
• URL - https://65.255.135.178/limto1.tar -
• URL - https://67.222.201.105/limto1.tar -
• URL - https://91.240.236.122/limto1.tar -
• URL - https://69.9.204.114/limto1.tar -
• URL - https://190.121.163.46/limto1.tar -
• URL - https://181.40.117.66/limto1.tar -
• URL - https://69.144.171.44/limto1.tar -
• URL - https://37.57.144.177/limto1.tar -
• URL - https://88.93.122.150/limto1.tar -
• URL - https://188.93.122.150/limto1.tar -
• URL - https://72.230.82.80/limto1.tar -
• URL - https://82.160.64.45/limto1.tar -
• URL - https://112.133.203.43/limto1.tar -
• URL - https://93.183.155.22/limto1.tar -
• URL - https://24.33.131.116/limto1.tar -
• URL - https://85.11.144.37/limto1.tar -
• URL - https://45.64.159.18/limto1.tar -
• URL - https://186.16.203.154/limto1.tar -
• URL - https://185.89.64.160/limto1.tar -
• URL - https://94.40.82.239/limto1.tar -
• URL - https://202.79.57.155/limto1.tar -
• URL - https://212.72.123.130/limto1.tar -
• URL - https://68.70.242.203/limto1.tar -
• URL - https://91.240.236.148/limto1.tar -
• URL - https://78.108.101.67/limto1.tar -
• URL - https://197.210.199.21/limto1.tar -
• URL - https://24.148.217.188/limto1.tar -
• URL - https://190.121.164.10/limto1.tar -
• URL - https://173.248.31.6/limto1.tar -

類似Pulses

• Dridex, Vawtrak and others increase focus on Canada (score: 0.70)
• Dyre: Emerging threat on financial fraud landscape (score: 0.68)
• Dyre Botnet Using Malicious Microsoft Word Macros (score: 0.68)
• TrendLabs: Spam Campaign Delivers Cross-platform Remote Access Trojan Adwind (score: 0.67)
• Aggressive Malware Pushers: Prolific Cyber Surfers Beware (score: 0.66)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る