A New Wave Of WIN32/CAPHAW Attacks

ThreatLabZ analyzes an active Win32/Caphaw banking trojan campaign that targets credentials for 24 financial institutions; the malware employs a domain generation algorithm (DGA), self-signed SSL-encrypted C2, process injection into explorer/iexplore, persistence via autorun/registry changes, anti-VM checks, and likely its initial delivery via a Java-focused exploit kit. The report provides example DGA domains, observed drop locations and filenames, API calls, registry modifications, and counts of samples and IPs to support detection and mitigation.