Vawtrak

Overview

Vawtrak (widely cataloged across international law enforcement and intelligence communities as Neverquest or Snifula) is one of the most damaging banking trojans of the 2010s, first observed in 2013. Designed for large-scale financial theft, Vawtrak compromised thousands of victim bank accounts across major financial institutions globally, stealing millions of dollars. Vawtrak was authored with roots tracing back to the Gozi (ISFB) and Shiz trojan codebases. It executes man-in-the-browser (MitB) webinjects to intercept online banking credentials, bypass two-factor authentication, and establish covert VNC connections allowing operators to conduct fraudulent transactions from the victim's own authenticated browser session. In January 2017, Spanish police arrested Russian mastermind Stanislav Lisov (known online as 'Black' and 'BlackDB') in Barcelona pursuant to an FBI warrant. In February 2019, Lisov pleaded guilty in the US District Court for the Southern District of New York (SDNY) to conspiring to commit computer hacking through the development and administration of Neverquest/Vawtrak, and was sentenced in November 2019.

Known aliases

Threat reports may refer to this family under multiple names:

• Vawtrak
• Neverquest
• Snifula
• Win32/Vawtrak
• Trojan.Vawtrak

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Stanislav Lisov ('Black' / 'BlackDB') - SDNY Federal Conviction High confidence
  Basis: Russian national Stanislav Lisov was arrested in Spain in 2017 and pleaded guilty in US District Court (SDNY) in 2019 to creating, updating, and operating the Neverquest/Vawtrak banking trojan network. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Gozi / Isfb · Shiz

Known Derivatives & Downstream Variants: Vawtrak Version 1 (2013) · Vawtrak Version 2 (Dga & Steganography Delivery) · Snifula Core

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2012-0158 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2014-1761 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2015-5119 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c
• 4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b

Delivery vectors

• Malicious email attachments exploiting Microsoft Office (CVE-2012-0158, CVE-2014-1761)
• Exploit kits (Angler, Neutrino) targeting Adobe Flash (CVE-2015-5119)

Persistence mechanisms

• Process injection into explorer.exe and web browsers (Chrome, Firefox, Internet Explorer)
• Registry Run keys and scheduled tasks executing injected DLLs

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_VAWTRAK_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vawtrak"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "vawtrak" ascii wide nocase
        $s2 = "vawtrak" ascii wide nocase
        $s3 = "neverquest" ascii wide nocase
        $s4 = "snifula" ascii wide nocase
        $s5 = "win32/vawtrak" ascii wide nocase
        $s6 = "trojan.vawtrak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Vawtrak (Banking Trojan) Execution & Triage
id: 82fddfca-1e52-5295-991f-e1d9e984d863
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Vawtrak malware family. Detects recon staging, certutil file payload staging,
  and web-inject process proxying characteristic of banking trojan initial loaders.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/vawtrak
- https://malware-families-catalog.systemhelpdesk.com/defensive/banking-trojan-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.banking-trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1056_001
- attack.t1113
- attack.t1071_001
- attack.t1547_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \svchost.exe
    - \explorer.exe
    - \msiexec.exe
    - \certutil.exe
    CommandLine|contains:
    - -urlcache
    - -split -f
    - ipconfig /all
    - route print
    - netstat -ano
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_VAWTRAK_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vawtrak tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "vawtrak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Disconnect the endpoint immediately to terminate the attacker's hidden VNC session and halt financial transactions.
2. Force a password reset for all financial institutions, ensuring the user logs in from a known-clean device.
3. Capture a memory dump before powering down the machine to extract Vawtrak's decrypted web inject configuration and steganographic payload.
4. Deploy Endpoint Detection and Response (EDR) rules to hunt for unauthorized DLL injections within <code>explorer.exe</code>.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume two-factor authentication (2FA) via SMS is sufficient protection; Vawtrak's web injects will dynamically prompt the user for the code and steal it.
2. Avoid relying on static signatures, as Vawtrak frequently updates its packed modules and obfuscates its C2 traffic.

References & External Analysis

• US DOJ SDNY Sentencing of Neverquest Mastermind Stanislav Lisov
• MITRE ATT&CK - Vawtrak
• CISA Advisory - Neverquest Banking Trojan Threat Overview
• Search "vawtrak" on VirusTotal (External Analysis)
• Search "vawtrak" on Any.Run (Sandbox Sandbox)
• Search "vawtrak" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Banking Trojan)

Explore other documented threats in the same operational category:

• Shiotob
• Blackmoon
• Dreambot
• Guildma
• Spyeye
• Shiz
• Dridex
• Alien

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/vawtrak.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.