Hackers use '.enc' trick to deliver Zeus banking malware
Zeus is encrypted and contained in an '.enc' file, which security products allow through, according to Malcovery Security
IDG News Service - Hackers found a new way to slip past security software and deliver Zeus, a long-known malicious software program that steals online banking details.
Security company Malcovery Security, based in Georgia, alerted security analysts after finding that none of 50 security programs on Google's online virus scanning service VirusTotal were catching it as of early Sunday.
Gary Warner, Malcovery's chief technologist, posted on his blog an assortment of spam messages, which spoofed brands and organizations such as the payment processor ADP, the Better Business Bureau and the British tax authority HMRC.
The spam messages contain a ".zip" file, which, if opened, contains a small application called UPATRE. That executable file downloads a ".enc" file, which it then decrypts. The decrypted file is GameOver Zeus, a variant of the notorious Zeus malware.
Zeus first appeared in 2006 and has long been a thorn in the side of banks. Its source code was leaked in May 2011, and cybercriminals have continued to make improvements to make its network more resilient, according to Dell's SecureWorks unit.
Security products are appearing to stumble on the ".enc" file since it doesn't end in ".exe," which designates an executable program, Warner wrote.
"Why? Well, because technically, it isn't malware," he wrote.
He advised that network administrators check their logs to see if any ".enc" files have been downloaded on their networks. The spam is distributed by the Cutwail botnet, another long-running botnet known for distributing malware.
"It is likely that many different criminals are paying to use this infrastructure," Warner wrote.
Send news tips and comments to firstname.lastname@example.org. Follow me on Twitter: @jeremy_kirk
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Building a Bridge to the Next Generation Data Center Selecting a widely adopted operating system is a foundational component of a standardization strategy.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Cybercrime and Hacking White Papers | Webcasts