Prometheus: Analyzing WebInject-based information stealers

Article type: Research Article

Authors: Continella, Andrea^{a; *} | Carminati, Michele^a | Polino, Mario^a | Lanzi, Andrea^b | Zanero, Stefano^a | Maggi, Federico^a

Affiliations: [a] Politecnico di Milano, Italy. E-mails: andrea.continella@polimi.it, michele.carminati@polimi.it, mario.polino@polimi.it, stefano.zanero@polimi.it, federico.maggi@polimi.it | [b] Università degli Studi di Milano, Italy. E-mail: andrea.lanzi@unimi.it

Correspondence: [*] Corresponding author. E-mail: andrea.continella@polimi.it.

Abstract: Nowadays Information stealers are reaching high levels of sophistication. The number of families and variants observed increased exponentially in the last years. Furthermore, these trojans are sold on underground markets along with automatic frameworks that include web-based administration panels, builders and customization procedures. From a technical point of view such malware is equipped with a functionality, called WebInject, that exploits API hooking techniques to intercept all sensitive data in a browser context and modify web pages on infected hosts. In this paper we propose Prometheus, an automatic system that is able to analyze trojans that base their attack technique on DOM modifications. Prometheus is able to identify the injection operations performed by malware, and generate signatures based on the injection behavior. Furthermore, it is able to extract the WebInject targets by using memory forensic techniques. We evaluated Prometheus against real-world, online websites and a dataset of distinct variants of financial trojans. In our experiments we show that our approach correctly recognizes known variants of WebInject-based malware and successfully extracts the WebInject targets.

Keywords: WebInject, banking trojan, info-stealer

DOI: 10.3233/JCS-15773

Journal: Journal of Computer Security, vol. 25, no. 2, pp. 117-137, 2017