Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:41 PM

New ZeuS Banking Trojan Targets 64-Bit Systems, Leverages Tor

Kaspersky Lab researchers discover a new 64-bit version of ZeuS that uses Tor

Change is in the wind on malware's Mount Olympus: The notorious ZeuS Trojan is now armed with a 64-bit version that uses the Tor network to communicate with its command-and-control infrastructure.

"The more people switch to 64-bit platforms, the more 64-bit malware appears," blogs Kaspersky Lab researcher Dmitry Tarakanov. "We have been following this process for several years now."

It's a new twist for ZeuS, to be sure, but also a confusing one because 64-bit browsers are not widely used by the public.

"ZeuS is mostly intended to intercept data passing through browsers and modify that data, allowing the operator to steal information related to online banking, to wire transactions, or to cover his tracks," Tarakanov writes. "But nowadays people still use 32-bit browsers -- even on 64-bit operating systems. So 32-bit versions of ZeuS have been sufficient to keep the thieves satisfied with their earnings."

Fortinet's Richard Henderson agreed, calling 64-bit malware "very uncommon." The real question, however, is how long it will be until it is not the exception, but the norm.

"Typically, malware is written in order to cast as wide of a net as possible, and that means sticking with what has the greatest chance of capturing the largest number of infections," says Henderson, security strategist for Fortinet's FortiGuard Threat Research and Response Labs. "Win32 64-bit Windows still run 32-bit applications, and as the analysis mentioned, the vast majority of 64-bit Windows users are still running 32-bit Internet browsers. It’s also the main reason why we don’t see a lot of Mac malware in the wild -- the number of computers out there running 32-bit Windows or 64-bit Windows with the ability to run 32-bit software is orders of magnitude larger."

The 64-bit version of the malware has been in the wild for at least six months. According to Kaspersky Lab, the 64-bit version was actually found inside a 32-bit ZeuS sample that injected malicious code into target processes and injected the 64-bit version into the process as if it belonged to a 64-bit application. If the process belongs to a 32-bit application, then the malware pushes the 32-bit version.

The 64-bit version behaves like any other variant of ZeuS, installing files into folders with randomly generated names placed inside of the %APPDATA% directory.

"Interestingly, the configuration file for this version of ZeuS includes a long list of programs that the malware can function on if they are found on the infected system," Tarakanov blogs. "There are different types of programs, but all of them contain valuable private information that cybercriminals would love to steal -- login credentials, certificates and so on. Don’t forget that ZeuS is capable of intercepting key strokes and data before encryption/after decryption that is sent/received on a network with the use of some typical system API functions. So, when operating inside these programs ZeuS is able to intercept and forward a lot of valuable information to the botnet operator."

In addition to the 64-bit component, this version of ZeuS maintains a tor.exe utility from the version inside its body, he adds.

"Tor.exe is launched indirectly -- ZeuS starts the system svchost.exe application in suspended mode, then injects the tor.exe code into this suspended svchost.exe process, tunes the code to run properly and resumes execution of the suspended svchost," Tarakanov explains. "As a result, instead of the system svchost.exe, the process actually starts executing tor.exe. The Tor utility under the cover of the svchost.exe process creates an HTTP proxy server listening to the TCP port 9050."

ZeuS variants using Tor, however, is nothing new; in actuality, Kaspersky Lab has tracked samples with signs of Tor communications as far back as 2012. Step-by-step instructions are even on the Internet on how to use tor.exe to pass ZeuS or SpyEye traffic via the Tor network, as well as how to create onion domain hosting for command-and-control for these banking Trojans.

"But these earlier samples mostly had CnC [command and control] domains specified in their bodies as localhost or meaning that samples of ZeuS or Spyeye themselves were not tied too strictly with Tor communications, whereas the version of ZeuS described [here]…has CnC onion domain egzh3ktnywjwabxb.onion defined in its internal block of settings," the Kaspersky researcher notes. "And tor.exe is included directly in its body and is run by ZeuS itself. So Tor communications and the 64-bit version are inseparable parts of this ZeuS sample, with the functionality included at the very development stage."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-09-19
An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->l...
PUBLISHED: 2019-09-19
Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server information.
PUBLISHED: 2019-09-19
Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, when sending a file to a remote server, as demonstrated by the file=http%3A%2F%2F192.168.1.2 substring.
PUBLISHED: 2019-09-19
In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (Prohibition of this zero value is only enforced within the GUI.)
PUBLISHED: 2019-09-19
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose.