Detects Shifu Banking Trojan

Hunt Hypothesis

This hunt hypothesis targets the specific execution patterns of the Shifu Banking Trojan to identify early-stage credential theft and financial data exfiltration within the environment. Proactively hunting for this low-severity threat in Azure Sentinel is critical because its subtle initial footprint often evades standard alerting, allowing adversaries to establish persistence before triggering high-priority security events.

YARA Rule

rule Shifu_Banking_Trojan_0 : banking {
	meta:
		description = "Detects Shifu Banking Trojan"
		author = "Florian Roth"
		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
		date = "2015-09-01"
		hash1 = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
		hash2 = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
	strings:
		$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii

		$s1 = "listen above" fullword wide
		$s2 = "familycould cost" fullword wide
		$s3 = "SetSystemTimeAdjustment" fullword ascii /* Goodware String - occured 33 times */
		$s4 = "PeekNamedPipe" fullword ascii /* Goodware String - occured 347 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and ($x1 or all of ($s*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects Shifu Banking Trojan rule in an enterprise environment, including suggested filters and exclusions:

Scenario: Automated Browser Updates via Microsoft Edge or Chrome Enterprise Policies
- Context: The Shifu Trojan often mimics legitimate browser behavior by injecting code into browser processes. In a managed enterprise, the Group Policy (GPO) or Microsoft Intune pushes automatic updates to msedge.exe or chrome.exe, which can trigger file integrity alerts or suspicious injection behaviors identical to the Trojan’s signature.
- Suggested Filter: Create an exclusion for update executables running from trusted vendor paths (e.g., C:\Program Files\Microsoft\Edge\Application\*) and specifically exclude processes spawned by msedge.exe when the parent process is Update.exe or GoogleUpdate.exe.
Scenario: Scheduled RDP Session Launches via Citrix Workspace
- Context: Shifu Banking Trojans frequently target Remote Desktop Protocol (RDP) sessions to intercept credentials. In a legitimate environment, scheduled tasks using Task Scheduler may launch Citrix Workspace (CitrixWorkspaceApp.exe) or Microsoft Remote Desktop (mstsc.exe) for automated reporting or maintenance windows, generating network connection patterns that resemble the Trojan’s command-and-control (C2) communication.
- Suggested Filter: Exclude traffic and process execution events originating from the System account during defined business hours (e.g., 08:00–17:00) where the parent process is svchost.exe running under the “Task Scheduler” service, specifically targeting connections to internal Citrix servers.
Scenario: Endpoint Detection and Response (EDR) Self-Scanning Activities
- Context: The detection logic likely flags memory scanning or file enumeration activities typical of Shifu