Did You Know?



Reply
Community Leader
Jasper_The_Rasper
Posts: 1,062
Registered: ‎06-12-2013

Zeus variant by-passing security, say researchers

A variant of the data-stealing Zeus Trojan – best known for targeting online banking – is using a new technique to bypass security systems, researchers have found.

By encrypting the executable file, cyber criminals are sneaking GameOver Zeus malware past web filters, network intrusion detection systems and other defences as a non-executable .enc file.

On 1 February 2014, US-based Malcovery Security alerted the security community and law enforcement agencies after its researchers identified the technique and observed its use trending upwards.

The attackers are using email messages that appear to come from HMRC, HSBC and other well-known brands to trick recipients into opening an attached .zip file, according to a Malcovery blog post.

If the attachment is opened, it launches a new version of the application called Upatre, which downloads and decrypts a .enc file, which is GameOver Zeus executable.

“If you are in charge of network security for your enterprise, you may want to check your logs to see how many .enc files have been downloaded recently,” said Gary Warner, CTO of Malcovery.

Before Malcovery raised the alarm, its researchers found none of the 50 security products used by online virus scanning service VirusTotal were blocking GameOver Zeus distributed in this way.

 

Full Article

Community Leader

Please use plain text.
Frequent Voice
rikardz
Posts: 39
Registered: ‎03-04-2013

Re: Zeus variant by-passing security, say researchers

And how would Webroot SecureAnywhere handle this piece of malware? As "unknown" with limited system access?

Please use plain text.
Moderator
Rakanisheu
Posts: 684
Registered: ‎03-13-2013

Re: Zeus variant by-passing security, say researchers

Nothing really new its still has to execute. I am going to check out the blog and I`ll report my findings

Please use plain text.
Moderator
Rakanisheu
Posts: 684
Registered: ‎03-13-2013

Re: Zeus variant by-passing security, say researchers

[ Edited ]

As expected we have seen this ages ago, but we are not on VT so we werent included in the 50 AV Vendors :smileyhappy:

 

Invoice.PDF.exe -seen Jan 27

Employer_Bulletin_Issue_46_79520EEE31.exe -seen Jan 28

PaymentAdvice.exe -seen Jan-27

 

I am not going to go through all of the post but its nothing new really.

Please use plain text.
Frequent Voice
rikardz
Posts: 39
Registered: ‎03-04-2013

Re: Zeus variant by-passing security, say researchers

Thanks for checking.
Please use plain text.