Menu
Hackers use a trick to deliver Zeus banking malware

Hackers use a trick to deliver Zeus banking malware

Zeus is encrypted and contained in an ".enc" file, which security products allow through, according to Malcovery Security

Hackers found a new way to slip past security software and deliver Zeus, a long-known malicious software program that steals online banking details.

Security company Malcovery Security, based in Georgia, alerted security analysts after finding that none of 50 security programs on Google's online virus scanning service VirusTotal were catching it as of early Sunday.

Gary Warner, Malcovery's chief technologist, posted on his blog an assortment of spam messages, which spoofed brands and organizations such as the payment processor ADP, the Better Business Bureau and the British tax authority HMRC.

The spam messages contain a ".zip" file, which, if opened, contains a small application called UPATRE. That executable file downloads a ".enc" file, which it then decrypts. The decrypted file is GameOver Zeus, a variant of the notorious Zeus malware.

Zeus first appeared in 2006 and has long been a thorn in the side of banks. Its source code was leaked in May 2011, and cybercriminals have continued to make improvements to make its network more resilient, according to Dell's SecureWorks unit.

Security products are appearing to stumble on the ".enc" file since it doesn't end in ".exe," which designates an executable program, Warner wrote.

"Why? Well, because technically, it isn't malware," he wrote.

He advised that network administrators check their logs to see if any ".enc" files have been downloaded on their networks. The spam is distributed by the Cutwail botnet, another long-running botnet known for distributing malware.

"It is likely that many different criminals are paying to use this infrastructure," Warner wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Malcovery SecuritysecurityDesktop securityencryptionExploits / vulnerabilitiesdata protectionmalware

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Show Comments