Hackers use '.enc' trick to deliver Zeus banking malware
Zeus is encrypted and contained in an '.enc' file, which security products allow through, according to Malcovery Security
IDG News Service - Hackers found a new way to slip past security software and deliver Zeus, a long-known malicious software program that steals online banking details.
Security company Malcovery Security, based in Georgia, alerted security analysts after finding that none of 50 security programs on Google's online virus scanning service VirusTotal were catching it as of early Sunday.
Gary Warner, Malcovery's chief technologist, posted on his blog an assortment of spam messages, which spoofed brands and organizations such as the payment processor ADP, the Better Business Bureau and the British tax authority HMRC.
The spam messages contain a ".zip" file, which, if opened, contains a small application called UPATRE. That executable file downloads a ".enc" file, which it then decrypts. The decrypted file is GameOver Zeus, a variant of the notorious Zeus malware.
Zeus first appeared in 2006 and has long been a thorn in the side of banks. Its source code was leaked in May 2011, and cybercriminals have continued to make improvements to make its network more resilient, according to Dell's SecureWorks unit.
Security products are appearing to stumble on the ".enc" file since it doesn't end in ".exe," which designates an executable program, Warner wrote.
"Why? Well, because technically, it isn't malware," he wrote.
He advised that network administrators check their logs to see if any ".enc" files have been downloaded on their networks. The spam is distributed by the Cutwail botnet, another long-running botnet known for distributing malware.
"It is likely that many different criminals are paying to use this infrastructure," Warner wrote.
Send news tips and comments to email@example.com. Follow me on Twitter: @jeremy_kirk
- The New Business Case for Video Conferencing: 7 Real-World Benefits Beyond Cost-Savings This whitepaper provides insight into the value of video conferencing in today's business environment, and how organizations are using visual collaboration to find...
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- Audit Ready and Asset Optimized: The Solid Promise of an Intelligent Software Asset Management Solution In this paper Frost & Sullivan examines the benefits of enterprise-grade Software Asset Management solutions, and how these solutions serve as the convergence...
- Pragmatic Endpoint Management: Empowering an SMB Workforce in the Age of Mobility Lacking the time for proper training and education, SMB administrators often resort to taking shortcuts to keep their environment running.This paper discusses the...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Cybercrime and Hacking White Papers | Webcasts