reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-banking-trojan-webinjects/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: analyzing-banking-trojan-webinjects
+description: 'Analyzes banking trojan webinject configurations to extract targeted institutions,
+  injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for
+  requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks
+  and credential-theft injections.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - banking-trojan
+  - webinject
+  - fraud
+  - credential-theft
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1185
+  - T1557
+  - T1056.001
+d3fend:
+  - D3-SDA
+  - D3-DA
+references:
+  - 'MITRE ATT&CK T1185 Browser Session Hijacking — https://attack.mitre.org/techniques/T1185/'
+  - 'Zeus/SpyEye webinject format (public malware research) — https://attack.mitre.org/software/S0259/'
+---
+
+# Analyzing Banking Trojan Webinjects
+
+## When to Use
+
+- You have a banking trojan webinject config (Zeus/Gozi/Dridex-style `set_url`/`data_before`/
+  `data_inject` blocks) and want to extract targeted institutions and injected code.
+- You are mapping the web-fraud workflow (form-grabbing, fake fields, MFA interception).
+
+**Do not use** this to deploy or test injects against live banking sites. This skill parses the
+config statically and executes nothing.
+
+## Prerequisites
+
+- The decoded webinject config text (decrypt the config first if needed).
+
+## Safety & Handling
+
+- Treat injected JS/HTML as malicious; do not render it. Defang any exfil URLs.
+
+## Workflow
+
+### Step 1: Parse webinject blocks
+
+```bash
+python scripts/analyst.py parse webinjects.txt
+```
+
+Parses `set_url`/`data_before`/`data_inject`/`data_after` blocks into structured entries with the
+targeted URL pattern and the injected snippet.
+
+### Step 2: Extract targets and exfil endpoints
+
+List targeted institution URL patterns and any exfil endpoints referenced by the injected code.
+
+### Step 3: Classify the injection technique
+
+Identify form-grabbing, fake additional fields (SSN, PIN, card), and MFA/OTP interception from the
+injected markup/JS.
+
+### Step 4: Defang and report
+
+Defang URLs and summarize targeted banks and theft techniques.
+
+## Validation
+
+- Each webinject block is parsed into target URL + injection.
+- Exfil endpoints in injected code are extracted and defanged.
+- Injection techniques are classified from the snippet content.
+
+## Pitfalls
+
+- Encrypted/packed configs needing decryption before parsing.
+- Wildcard URL patterns matching broadly — note the scope.
+- Obfuscated injected JS hiding the true exfil endpoint.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the parser.
+- ATT&CK T1185 and webinject format references (linked in frontmatter).