GozNym Trojan combines Gozi ISFB and Nymaim malware abilities

The security experts from the  IBM X-Force Research spotted a new threat dubbed GozNym Trojan that combines Gozi ISFB and Nymaim malware abilities.

What happens when two threats join their capabilities?

Two dangerous Trojans, the Nymaim and Gozi ISFB malware, have been merged to create a new banking Trojan called GozNym.

The GozNym Trojan is particularly insidious, according to the experts at the IBM X-Force Research, it is responsible for the theft of $4 million since it was first discovered a couple of two weeks ago.

According to the researchers, the new malware is currently involved in a campaign that is targeting business banking institutions, credit unions and retail banks.

“IBM X-Force Research uncovered a Trojan hybrid spawned from the Nymaim and GoziISFB malware. It appears that the operators of Nymaim have recompiled its source code with part of the Gozi ISFB source code, creating a combination that is being actively used in attacks against more than 24 U.S. and Canadian banks, stealing millions so far. X-Force named this new hybrid GozNym.” States a report published by the IBM X-Force Research.  

The GozNym combines the best characteristics of both malware, it leverages on the Nymaim dropper and the stealing capabilities of the Gozi ISFB.

“From the Nymaim malware, it leverages the dropper’s stealth and persistence; the Gozi ISFB parts add the banking Trojan’s capabilities to facilitate fraud via infected Internet browsers. The end result is a new banking Trojan in the wild.” continues the post.

The new banking trojan is spread via email messages that comes with documents embedding malicious macros.

Once GozNym has infected the victim’s machine, it is able to manipulate the browser in order to steal credentials and money from bank accounts my manipulating web session through webinjection mechanisms.

Limor Kessem, cybersecurity expert with IBM’s X-Force Research division, explained that the two malware behind the GozNym Trojan perfectly work together, in a much more effective way than apart.

The GozNym Trojan implements a two-stage malware dropper to compromise a victim’s computer.

“Nymaim is a two-stage malware dropper. It usually infiltrates computers through exploit kits and then executes the second stage of its payload once it is on the machine, effectively using two executables for the infection routine.” Continues the post. “Before merging into an actual hybrid, earlier versions of Nymaim used to fetch and inject Gozi ISFB’s financial module as a complete DLL into the infected victim’s browser to enable web-injections on online banking sites” states the report.

As usually happens in these cases, the birth of the new GozNym malware resulted from the availability of the source codes of the Nymaim and Gozi ISFB threats.

We will continue to follow the evolution of the new malicious code.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – GozNym, malware)