Categories: Malware

Zeus, Cryptolocker and more, malware evolution according TrendMicro

A rapid look to last trends in malware development observed by security experts at TrendMicro, old threat including new improvements.

Security experts have observed during last months an increase in the use of AutoIt coding language To Spread Malware and Toolsets. AutoIt is a very flexible scripting language used since 1999 in Windows environments. The language was used to perform simple operations like text file editing but allows also the creation of more complex scripts that perform mass downloads with complex GUIs.

AutoIt is an easy-to-learn language that allows for quick development,due this reason it was chosen by numerous malware author.

In 2013 security firm have detected an alarming increase for infostealer malware and banking trojans, there were observed new variants of the popular ZeuS designed for 64bit systems and able to exploit Tor networks to hide C&C servers.  The new variant for 64 bit architecture includes a malicious AutoIt file and garbage files, it is spread via email message and the unpacked file it recognized as as TSPY_ZBOT.SMIG.  Exactly like other ZeuS malware version it drops a configuration file that contains a list of its targets (e.g. Banks, Financial organizations).

But malware is even more complex, new instances are also able to steal data from different FTP sites and personal certificates from the infected host.

Malware analysts at Trend Micro spotted other malicious code with same packer, TSPY_CHISBURG.A and TSPY_EUPUDS.A, while the first one steals user names and passwords from Yahoo, Hotmail, Pidgin, FileZilla, and VPN/ISP credentials once is loaded in memory, the second one collect victim’s info (e.g. User ID, browser and version, OS version) and user’s credentials.

Infostealers are privileged tools for cybercriminals to collect tools information to sell in the underground cybercrime, these info are used for fraud arrangement or to organize targeted attacks.

Returning to AutoIt packer, a new code was found online to implement propagation mechanism via removable drives. The code is able to checks installed antivirus software on the system and it includes obfuscated  functions to make it harder the detection.

Thanks to improved AutoIt packer also old malware could be effective as explained by TrendMicro experts.

“With the incorporation of malware to a scripting language such as AutoIt, it makes analysis arduous especially if there is no decompiler that can aid in the analysis.  AutoIt is also used by normal applications, thus there is need for malware which are compressed to be unpacked so as to get only the malicious routines/behavior.”

Infostealers aren’t unique malware to menace user’s security, the 2013 was considere also the year of ransomware, Cryptolocker for example has infected about 250,000 PCs mainly from US, UK and Australia.


Last variant of CryptoLocker detected by TrendMicro includes a new notable propagation feature, the instance WORM_CRILOCK.A has the capability to spread via removable drives.

“Aside from its propagation technique, the new malware bears numerous differences from known CryptoLocker variants. Rather than relying on a downloader malware—often UPATRE— to infect systems, this malware pretends to be an activator for various software such as Adobe Photoshop and Microsoft Office in peer-to-peer (P2P) file sharing sites. Uploading the malware in P2P sites allows bad guys to easily infect systems without the need to create (and send) spammed messages.” states TrendMicro post.

The example provided show the continuous improvement of the cybercrime ecosystem to malicious tools like infostealer and ransomware, cybercrime menace is becoming even more insidious and sophisticated.


[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs –  malware, TrendMicro)

[adrotate banner=”5″]

[adrotate banner=”13″]


Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

New AT&T data breach exposed call logs of almost all customers

AT&T disclosed a new data breach that exposed phone call and text message records for…

19 hours ago

Critical flaw in Exim MTA could allow to deliver malware to users’ inboxes

A critical vulnerability in Exim mail server allows attackers to deliver malicious executable attachments to…

21 hours ago

Palo Alto Networks fixed a critical bug in the Expedition tool

Palo Alto Networks addressed five vulnerabilities impacting its products, including a critical authentication bypass issue. Palo…

1 day ago

Smishing Triad Is Targeting India To Steal Personal and Payment Data at Scale

Resecurity has identified a new campaign by the Smishing Triad that is targeting India to…

1 day ago

October ransomware attack on Dallas County impacted over 200,000 people

The ransomware attack that hit Dallas County in October 2023 has impacted more than 200,000…

1 day ago

CrystalRay operations have scaled 10x to over 1,500 victims

A threat actor known as CrystalRay targeted 1,500 victims since February using tools like SSH-Snake…

2 days ago

This website uses cookies.