Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/12/2013
01:41 PM
50%
50%

New ZeuS Banking Trojan Targets 64-Bit Systems, Leverages Tor

Kaspersky Lab researchers discover a new 64-bit version of ZeuS that uses Tor

Change is in the wind on malware's Mount Olympus: The notorious ZeuS Trojan is now armed with a 64-bit version that uses the Tor network to communicate with its command-and-control infrastructure.

"The more people switch to 64-bit platforms, the more 64-bit malware appears," blogs Kaspersky Lab researcher Dmitry Tarakanov. "We have been following this process for several years now."

It's a new twist for ZeuS, to be sure, but also a confusing one because 64-bit browsers are not widely used by the public.

"ZeuS is mostly intended to intercept data passing through browsers and modify that data, allowing the operator to steal information related to online banking, to wire transactions, or to cover his tracks," Tarakanov writes. "But nowadays people still use 32-bit browsers -- even on 64-bit operating systems. So 32-bit versions of ZeuS have been sufficient to keep the thieves satisfied with their earnings."

Fortinet's Richard Henderson agreed, calling 64-bit malware "very uncommon." The real question, however, is how long it will be until it is not the exception, but the norm.

"Typically, malware is written in order to cast as wide of a net as possible, and that means sticking with what has the greatest chance of capturing the largest number of infections," says Henderson, security strategist for Fortinet's FortiGuard Threat Research and Response Labs. "Win32 64-bit Windows still run 32-bit applications, and as the analysis mentioned, the vast majority of 64-bit Windows users are still running 32-bit Internet browsers. It’s also the main reason why we don’t see a lot of Mac malware in the wild -- the number of computers out there running 32-bit Windows or 64-bit Windows with the ability to run 32-bit software is orders of magnitude larger."

The 64-bit version of the malware has been in the wild for at least six months. According to Kaspersky Lab, the 64-bit version was actually found inside a 32-bit ZeuS sample that injected malicious code into target processes and injected the 64-bit version into the process as if it belonged to a 64-bit application. If the process belongs to a 32-bit application, then the malware pushes the 32-bit version.

The 64-bit version behaves like any other variant of ZeuS, installing files into folders with randomly generated names placed inside of the %APPDATA% directory.

"Interestingly, the configuration file for this version of ZeuS includes a long list of programs that the malware can function on if they are found on the infected system," Tarakanov blogs. "There are different types of programs, but all of them contain valuable private information that cybercriminals would love to steal -- login credentials, certificates and so on. Don’t forget that ZeuS is capable of intercepting key strokes and data before encryption/after decryption that is sent/received on a network with the use of some typical system API functions. So, when operating inside these programs ZeuS is able to intercept and forward a lot of valuable information to the botnet operator."

In addition to the 64-bit component, this version of ZeuS maintains a tor.exe utility from the 0.2.3.25 version inside its body, he adds.

"Tor.exe is launched indirectly -- ZeuS starts the system svchost.exe application in suspended mode, then injects the tor.exe code into this suspended svchost.exe process, tunes the code to run properly and resumes execution of the suspended svchost," Tarakanov explains. "As a result, instead of the system svchost.exe, the process actually starts executing tor.exe. The Tor utility under the cover of the svchost.exe process creates an HTTP proxy server listening to the TCP port 9050."

ZeuS variants using Tor, however, is nothing new; in actuality, Kaspersky Lab has tracked samples with signs of Tor communications as far back as 2012. Step-by-step instructions are even on the Internet on how to use tor.exe to pass ZeuS or SpyEye traffic via the Tor network, as well as how to create onion domain hosting for command-and-control for these banking Trojans.

"But these earlier samples mostly had CnC [command and control] domains specified in their bodies as localhost or 127.0.0.1 meaning that samples of ZeuS or Spyeye themselves were not tied too strictly with Tor communications, whereas the version of ZeuS described [here]…has CnC onion domain egzh3ktnywjwabxb.onion defined in its internal block of settings," the Kaspersky researcher notes. "And tor.exe is included directly in its body and is run by ZeuS itself. So Tor communications and the 64-bit version are inseparable parts of this ZeuS sample, with the functionality included at the very development stage."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9398
PUBLISHED: 2020-02-25
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
CVE-2015-5201
PUBLISHED: 2020-02-25
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows r...
CVE-2019-4000
PUBLISHED: 2020-02-25
Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges.
CVE-2015-0565
PUBLISHED: 2020-02-25
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
CVE-2020-9393
PUBLISHED: 2020-02-25
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.