Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/12/2013
01:41 PM
50%
50%

New ZeuS Banking Trojan Targets 64-Bit Systems, Leverages Tor

Kaspersky Lab researchers discover a new 64-bit version of ZeuS that uses Tor

Change is in the wind on malware's Mount Olympus: The notorious ZeuS Trojan is now armed with a 64-bit version that uses the Tor network to communicate with its command-and-control infrastructure.

"The more people switch to 64-bit platforms, the more 64-bit malware appears," blogs Kaspersky Lab researcher Dmitry Tarakanov. "We have been following this process for several years now."

It's a new twist for ZeuS, to be sure, but also a confusing one because 64-bit browsers are not widely used by the public.

"ZeuS is mostly intended to intercept data passing through browsers and modify that data, allowing the operator to steal information related to online banking, to wire transactions, or to cover his tracks," Tarakanov writes. "But nowadays people still use 32-bit browsers -- even on 64-bit operating systems. So 32-bit versions of ZeuS have been sufficient to keep the thieves satisfied with their earnings."

Fortinet's Richard Henderson agreed, calling 64-bit malware "very uncommon." The real question, however, is how long it will be until it is not the exception, but the norm.

"Typically, malware is written in order to cast as wide of a net as possible, and that means sticking with what has the greatest chance of capturing the largest number of infections," says Henderson, security strategist for Fortinet's FortiGuard Threat Research and Response Labs. "Win32 64-bit Windows still run 32-bit applications, and as the analysis mentioned, the vast majority of 64-bit Windows users are still running 32-bit Internet browsers. It’s also the main reason why we don’t see a lot of Mac malware in the wild -- the number of computers out there running 32-bit Windows or 64-bit Windows with the ability to run 32-bit software is orders of magnitude larger."

The 64-bit version of the malware has been in the wild for at least six months. According to Kaspersky Lab, the 64-bit version was actually found inside a 32-bit ZeuS sample that injected malicious code into target processes and injected the 64-bit version into the process as if it belonged to a 64-bit application. If the process belongs to a 32-bit application, then the malware pushes the 32-bit version.

The 64-bit version behaves like any other variant of ZeuS, installing files into folders with randomly generated names placed inside of the %APPDATA% directory.

"Interestingly, the configuration file for this version of ZeuS includes a long list of programs that the malware can function on if they are found on the infected system," Tarakanov blogs. "There are different types of programs, but all of them contain valuable private information that cybercriminals would love to steal -- login credentials, certificates and so on. Don’t forget that ZeuS is capable of intercepting key strokes and data before encryption/after decryption that is sent/received on a network with the use of some typical system API functions. So, when operating inside these programs ZeuS is able to intercept and forward a lot of valuable information to the botnet operator."

In addition to the 64-bit component, this version of ZeuS maintains a tor.exe utility from the 0.2.3.25 version inside its body, he adds.

"Tor.exe is launched indirectly -- ZeuS starts the system svchost.exe application in suspended mode, then injects the tor.exe code into this suspended svchost.exe process, tunes the code to run properly and resumes execution of the suspended svchost," Tarakanov explains. "As a result, instead of the system svchost.exe, the process actually starts executing tor.exe. The Tor utility under the cover of the svchost.exe process creates an HTTP proxy server listening to the TCP port 9050."

ZeuS variants using Tor, however, is nothing new; in actuality, Kaspersky Lab has tracked samples with signs of Tor communications as far back as 2012. Step-by-step instructions are even on the Internet on how to use tor.exe to pass ZeuS or SpyEye traffic via the Tor network, as well as how to create onion domain hosting for command-and-control for these banking Trojans.

"But these earlier samples mostly had CnC [command and control] domains specified in their bodies as localhost or 127.0.0.1 meaning that samples of ZeuS or Spyeye themselves were not tied too strictly with Tor communications, whereas the version of ZeuS described [here]…has CnC onion domain egzh3ktnywjwabxb.onion defined in its internal block of settings," the Kaspersky researcher notes. "And tor.exe is included directly in its body and is run by ZeuS itself. So Tor communications and the 64-bit version are inseparable parts of this ZeuS sample, with the functionality included at the very development stage."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30480
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
CVE-2021-21194
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21195
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21196
PUBLISHED: 2021-04-09
Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21197
PUBLISHED: 2021-04-09
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.