{
  "family": "shylock",
  "sample_count": 21,
  "category": "banking_trojan",
  "description": "TrojanDownloader:Win32/Shylock is an incredibly sophisticated, highly targeted banking trojan, notorious for its advanced 'Man-in-the-Browser' (MitB) capabilities and its innovative use of Domain Generation Algorithms (DGAs) combined with Skype for command and control resilience.<br><br><b>Understanding Shylock</b><br>To the victim, Shylock is entirely invisible until their bank account is drained. For a security analyst, Shylock (named after the Shakespearean character, due to its early code containing references to 'The Merchant of Venice') is a tier-one financial threat. It does not simply steal passwords; it actively modifies the victim's online banking session in real-time. It intercepts 2FA codes, alters transaction amounts dynamically, and hides the fraudulent transfers from the user's statement view.<br><br><b>Execution, Web Injects, and Mitigation Evasion</b><br>Shylock is typically distributed via drive-by downloads (`T1189`). Upon execution, it establishes persistence and immediately injects its core DLLs into `explorer.exe` (`T1055.001`). From there, it hooks the APIs of all running web browsers (Chrome, Firefox, IE) (`T1185`). When the user navigates to a targeted banking portal, Shylock's C2 server downloads a specific 'web inject' configuration. This allows Shylock to inject malicious HTML/JavaScript directly into the legitimate banking page (`T1111`), creating fake login forms or 2FA prompts that steal data directly from the DOM before it is encrypted by SSL/TLS.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive financial fraud that bypasses standard 2FA mechanisms. Network logs will reveal anomalous DGA-based DNS requests (`T1568.002`). EDR platforms must alert on the injection of DLLs into `explorer.exe` or browser processes. A highly specific IoC for Shylock is the creation of a hidden partition or the abuse of Alternate Data Streams (ADS) to store its encrypted Virtual File System (VFS) to evade forensic detection.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1568.002",
    "T1185",
    "T1055.001",
    "T1564.004",
    "T1111"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Man-in-the-Browser",
      "tactic": "Collection"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1564.004",
      "name": "Hide Artifacts: NTFS File Attributes",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; the attacker has active, real-time control over the user's web browser sessions.",
    "Initiate a mandatory password reset for all financial and corporate accounts accessed from the infected machine, utilizing a known-clean device.",
    "Capture a forensic memory image (RAM dump) to extract the decrypted web inject configurations and identify which specific banking portals were targeted.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force the revocation of any session tokens or cookies stored on the machine."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into any sensitive portal to 'check their balance'; the MitB trojan will intercept the login and modify the displayed balance.",
    "Avoid relying solely on basic antivirus scans, as Shylock stores its payload in encrypted Alternate Data Streams (ADS) that evade standard file-level scanning."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}