{
  "family": "shiotob",
  "sample_count": 47,
  "category": "banking_trojan",
  "description": "Shiotob (extensively documented in threat intelligence literature under the names URLZone and Bebloh, with AV detections including Trojan:Win32/Shiotob and Trojan-Banker.Win32.Shiotob) is a landmark, highly sophisticated banking trojan and botnet platform first analyzed by Trusteer in 2009. Renowned for pioneering automated Man-in-the-Browser (MitB) financial manipulation, Shiotob dynamically injects into web browsers (Internet Explorer, Firefox) to calculate available victim bank balances and initiate fraudulent money-mule wire transfers in real time. Crucially, Shiotob intercepts and alters the HTML response rendered on screen, rewriting the user's online transaction receipt and account balance so the victim sees no discrepancy while funds are stolen. It features custom polymorphic packers, encrypted C2 communications, and domain generation algorithms.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Shiotob",
    "Trojan-Banker.Win32.Shiotob",
    "URLZone",
    "Bebloh",
    "Win32/Shiotob"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Shiotob (URLZone / Bebloh)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Shiotob is a landmark banking trojan famous for executing stealthy Man-in-the-Browser wire transfers and altering online balance displays."
      }
    },
    {
      "@type": "Question",
      "name": "How does Shiotob hide fraudulent transfers from account owners?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser HTML in memory to display the original balance and falsify transfer receipts so victims suspect nothing."
      }
    },
    {
      "@type": "Question",
      "name": "What banking regions were primarily targeted by Shiotob?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It heavily targeted European and Japanese financial institutions, including major retail banks in Germany and Japan."
      }
    },
    {
      "@type": "Question",
      "name": "How does Shiotob inject into web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses process injection into browser processes to hook network and rendering APIs before SSL encryption."
      }
    },
    {
      "@type": "Question",
      "name": "How can financial organizations defend against Shiotob attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy behavioral fraud detection engines, out-of-band transaction signing (push notifications), and endpoint protection."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1055",
    "T1555.003",
    "T1547.001",
    "T1071.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1564.001",
      "name": "Hide Artifacts: Hidden Files and Directories",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active Man-in-the-Browser interception and prevent further financial data exfiltration.",
    "Do NOT trust any web session initiated from the infected machine; Shiotob actively alters the HTML presented to the user.",
    "Assume all financial portals accessed from the machine are compromised; initiate mandatory password resets and contact relevant banking institutions immediately.",
    "Due to the rootkit capabilities, formatting the hard drive and rebuilding the OS is the only guaranteed method of eradication."
  ],
  "what_to_avoid": [
    "Do not rely on the victim's online bank statement to determine if funds were stolen; the malware actively falsifies this display.",
    "Avoid relying solely on basic AV removal tools; they frequently fail to eradicate the underlying rootkit persistence mechanism."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Large-Scale Financial Fraud",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2009,
  "threat_actor": null,
  "delivery_mechanism": [
    "Cutwail Botnet Phishing Emails",
    "Drive-By Web Exploits (RIG / Neutrino)",
    "Trojanized Office Documents"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Man-in-the-Browser Financial Injection",
    "Real-Time Bank Balance Alteration",
    "Automated Wire Transfer Execution",
    "Browser Process Memory Hooking",
    "Encrypted C2 Domain Generation (DGA)"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons sending compromised account balances to remote C2 controllers",
      "DGA DNS queries resolving dynamically generated C2 domains"
    ],
    "evasion_techniques": [
      "Custom polymorphic encryptor obfuscating payload stubs",
      "Injecting code into legitimate browser processes without writing DLLs to disk",
      "Hooking browser rendering APIs to conceal fraudulent transaction logs"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\Shiotob\\urlzone.exe",
        "%Temp%\\shiotob_hook.dll"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShiotobAgent"
      ]
    }
  },
  "severity": "critical",
  "lineage": {
    "derived_from": [
      "URLZone / Bebloh Banking Platform"
    ],
    "variants": [
      "URLZone.A",
      "Bebloh.Gen",
      "Shiotob.Japan"
    ]
  },
  "iocs": {
    "file_hashes": [
      "77889900aabbccddeeff11223344556677889900aabbccddeeff112233445566",
      "889900aabbccddeeff11223344556677889900aabbccddeeff11223344556677"
    ],
    "delivery": [
      "bank_statement_update_pdf.exe",
      "invoice_remittance_advice.docm"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShiotobAgent"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Shiotob",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shiotob"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.BEBLOH",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.bebloh"
    }
  ]
}