Categories: Malware

Detected new Zeus variant which makes use of steganography

Security experts at Malwarebytes detected a new of the popular Zeus banking trojan variant which makes use of steganography to hide the configuration file.

The immortal Zeus malware strikes again, researchers at Malwarebytes have found a new variant of the banking trojan. The new variant of Zeus is using the steganography to disguise the configuration code in a digital photo. Zeus is known as one of the most effective tools, the public release of its source code permitted to many criminal groups to customize its behavior and to develop new features, including the possibility to hide the C&C server inside the Tor network. The variant detected by Malwarebytes, dubbed  Zeus VM, downloads a configuration file that contains the list of banks targeted by the malware, the malicious code is able to steal online banking details, hijacking login details to the attackers and mask the transfers of money to a bank account managed by criminals. As explained by Jerome Segura the use of steganography was first noted by noted by a French security researcher who uses the nickname Xylitol

“A new variant of this trojan, dubbed ZeusVM, is using images as a decoy to retrieve its configuration file, a vital piece for its proper operation. French security researcher Xylitol noted something strange in one of the malvertising campaigns I reported a couple weeks ago.The malware was retrieving a JPG image hosted on the same server as were other malware components. ” Segura wrote.

The use of steganography is not new, malware authors adopt it to avoid security defense systems embedding code in a file format that appears legitimate.

“Hiding malevolent code in such a way can successfully bypass signature-based Intrusion Detection Systems or even antivirus software. From a webmaster point of view, images (especially ones that can be viewed) would appear harmless.” Segura added.

The researchers discovered that the image used by the Zeus variant is much larger of the original image found with a simple research made with Google because cybercriminals added additional data encrypted using Base64 encoding and then RC4 and XOR encryption algorithms.

  Using an hexadecimal viewer it is possible to detect the malicious code added to the picture.

Once decrypted the above text it is possible to observe that ZeusVM targeted popular financial institutions including Barclays, Deutsche Bank and Wells Fargo.

Pierluigi Paganini

(Security Affairs –  Zeus VM, steganography)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Cisco warns of password-spraying attacks targeting Secure Firewall devices

Cisco warns customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services…

1 hour ago

American fast-fashion firm Hot Topic hit by credential stuffing attacks

Hot Topic suffered credential stuffing attacks that exposed customers' personal information and partial payment data.…

5 hours ago

Cisco addressed high-severity flaws in IOS and IOS XE software

Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…

19 hours ago

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

1 day ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

2 days ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

2 days ago

This website uses cookies.