New Zeus trojan variant digitally signed in the wild

Security researchers at Comodo have detected a new Zeus trojan variant enhanced with digital signature of its source code to avoid detection.

The security community is once again menaced by Zeus banking trojan, a new variant of the malicious  ZeuS Trojan has been identified by researchers at Comodo AV labs. This instance presents an interesting feature, it is digitally signed with a stolen digital certificate which belongs to Microsoft Developer.

The technique is not new in the past numerous malware were digitally signed to avoid detection from anti-virus systems, clamorous the theft of digital certificate from Bit9 occurred one year ago when the security company announced that hackers had stolen digital certificates from its network and have utilized it to sign malware. 

On Microsoft systems the installation of certain types of software could request that its code is digitally signed with a certificate issued by a trusted CA, by stealing the certificate of a trusted vendor reduces the possibility that the malicious software being detected as quickly. That is exactly what happened to Stuxnet virus, but let’s remark that the technique is very common in the criminal underground, more than 200,000 unique malware binaries were discovered in the last couple of years signed with valid digital signatures.

“The Comodo team identified the Zeus variant because they continuously monitor and analyze scan data from the users of Comodo’s internet security systems. They have found over 200 unique hits for this Zeus variant from our users so far.” reports the official 

The new Zeus trojan variant is distributed through infected web page components and via classic phishing email apparently sent by a trusted source including a major bank. The post reports the case of a Comodo user which provides a sample of Zeus Trojan that masquerade itself as file of Internet Explorer with a valid signature issued to “isonet ag”.

• lovestogarden.com/images/general/TARGT.tpl
• villaveronica.it/images/general/TARGT.tpl

The post published by Comodo On Zeus Trojan also explained how the malicious code implements the Man-In-The-Browser attack method, a technique that we discussed different time in the past.

“If the attack victim goes to an online banking site to perform a transaction, such as transferring funds, they see everything as occurring normally. The payment information they keyed will display as expected, but behind the scenes the hackers will alter the transaction and send it to another account with possibly a larger amount.” researchers explained.

“Its purpose is to protect malicious files and autorun entries from being deleted by user or antivirus software, increasing difficulty of the removal process.” reports Comodo experts.