IBM security researcher continues to monitor the evolution of the infamous Zeus Sphinx banking Trojan (aka Zloader or Terdot) that receives frequent updates and that was involved in active coronavirus scams.
The Zeus Sphinx banking Trojan is based on the code of the Zeus v.2 Trojan that was leaked online.
Operators were spreading it in a spam campaign aimed at stealing victims’ financial information, the spam messages sent to the victims claim to provide information related to the Coronavirus outbreak and government relief payments
Researchers revealed that the malware is receiving constant upgrades to improve its capabilities.
Zeus Sphinx is distributed through malspam campaigns that use weaponized office documents. The malware achieves persistence by adding a Run key to the Windows Registry, it can come in two different formats, an executable file or a dynamic link library (DLL).
The Trojan has been designed to grab banking details or account credentials for online services by leveraging browser injection techniques.
Zeus Sphinx injects malicious code into browser processes to redirect users to malicious websites.
The malware creates a process, named msiexec.exe, to avoid detection. The name msiexec.exe is usually associated with a legitimate Windows Installer process that is responsible for installation.
Compared with the campaigns observed in early 2020, the malware samples involved in the recent attacks included a new set of RC4 keys, a smaller and different set of C2s, and a new variant ID.
“Sphinx uses a pseudo-random number generator (PRNG) named MT19937 (also known as the Mersenne Twister). Let’s look at how Zeus Sphinx implements this PRNG to create names for its resources.” reads the analysis published by IBM.
“While less common in the wild than Trojans like TrickBot, for example, Sphinx’s underlying Zeus DNA has been an undying enabler of online banking fraud.” “Financial institutions must reckon with its return and spread to new victims amid the current pandemic.”
(SecurityAffairs – Zeus Sphinx, hacking)