| name | analyzing-banking-trojan-webinjects |
| description | Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections. |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | ["malware-analysis","banking-trojan","webinject","fraud","credential-theft"] |
| version | 1.0.0 |
| author | analyst-ai-pack |
| license | Apache-2.0 |
| mitre_attack | ["T1185","T1557","T1056.001"] |
| d3fend | ["D3-SDA","D3-DA"] |
| references | ["MITRE ATT&CK T1185 Browser Session Hijacking — https://attack.mitre.org/techniques/T1185/","Zeus/SpyEye webinject format (public malware research) — https://attack.mitre.org/software/S0259/"] |
Analyzing Banking Trojan Webinjects
When to Use
- You have a banking trojan webinject config (Zeus/Gozi/Dridex-style
set_url/data_before/
data_inject blocks) and want to extract targeted institutions and injected code.
- You are mapping the web-fraud workflow (form-grabbing, fake fields, MFA interception).
Do not use this to deploy or test injects against live banking sites. This skill parses the
config statically and executes nothing.
Prerequisites
- The decoded webinject config text (decrypt the config first if needed).
Safety & Handling
- Treat injected JS/HTML as malicious; do not render it. Defang any exfil URLs.
Workflow
Step 1: Parse webinject blocks
python scripts/analyst.py parse webinjects.txt
Parses set_url/data_before/data_inject/data_after blocks into structured entries with the
targeted URL pattern and the injected snippet.
Step 2: Extract targets and exfil endpoints
List targeted institution URL patterns and any exfil endpoints referenced by the injected code.
Step 3: Classify the injection technique
Identify form-grabbing, fake additional fields (SSN, PIN, card), and MFA/OTP interception from the
injected markup/JS.
Step 4: Defang and report
Defang URLs and summarize targeted banks and theft techniques.
Validation
- Each webinject block is parsed into target URL + injection.
- Exfil endpoints in injected code are extracted and defanged.
- Injection techniques are classified from the snippet content.
Pitfalls
- Encrypted/packed configs needing decryption before parsing.
- Wildcard URL patterns matching broadly — note the scope.
- Obfuscated injected JS hiding the true exfil endpoint.
References
