reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-banking-trojan-webinjects/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-banking-trojan-webinjects	Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.	cybersecurity	malware-analysis	malware-analysis banking-trojan webinject fraud credential-theft	1.0.0	analyst-ai-pack	Apache-2.0	T1185 T1557 T1056.001	D3-SDA D3-DA	MITRE ATT&CK T1185 Browser Session Hijacking — https://attack.mitre.org/techniques/T1185/ Zeus/SpyEye webinject format (public malware research) — https://attack.mitre.org/software/S0259/

Analyzing Banking Trojan Webinjects

When to Use

• You have a banking trojan webinject config (Zeus/Gozi/Dridex-style set_url/data_before/ data_inject blocks) and want to extract targeted institutions and injected code.
• You are mapping the web-fraud workflow (form-grabbing, fake fields, MFA interception).

Do not use this to deploy or test injects against live banking sites. This skill parses the config statically and executes nothing.

Prerequisites

• The decoded webinject config text (decrypt the config first if needed).

Safety & Handling

• Treat injected JS/HTML as malicious; do not render it. Defang any exfil URLs.

Workflow

Step 1: Parse webinject blocks

python scripts/analyst.py parse webinjects.txt

Parses set_url/data_before/data_inject/data_after blocks into structured entries with the targeted URL pattern and the injected snippet.

Step 2: Extract targets and exfil endpoints

List targeted institution URL patterns and any exfil endpoints referenced by the injected code.

Step 3: Classify the injection technique

Identify form-grabbing, fake additional fields (SSN, PIN, card), and MFA/OTP interception from the injected markup/JS.

Step 4: Defang and report

Defang URLs and summarize targeted banks and theft techniques.

Validation

• Each webinject block is parsed into target URL + injection.
• Exfil endpoints in injected code are extracted and defanged.
• Injection techniques are classified from the snippet content.

Pitfalls

• Encrypted/packed configs needing decryption before parsing.
• Wildcard URL patterns matching broadly — note the scope.
• Obfuscated injected JS hiding the true exfil endpoint.

References

• See references/api-reference.md for the parser.
• ATT&CK T1185 and webinject format references (linked in frontmatter).