Zloader malware makes a sudden resurgence .:. Andy Rixon
Zloader malware makes a sudden resurgence

Like a really bad penny

Security experts have warned that one of the most notorious malware campaigns of all time could be making a return.

Last December, researchers at Proofpoint noticed email campaigns containing a new version of the infamous Zeus banking malware. Since the new year, the company has traced over 100 such campaigns with recipients in the United States, Canada, Germany, Poland and Australia.

First surfacing in 2006, Zeus uses web injects to steal credentials and other private information from users of targeted financial institutions. The malware can also steal browser-stored passwords and cookies, and uses the Virtual Network Computing (VNC) client it downloads to make illicit financial transactions from the user’s legitimate device.

Zloader malware

In a blog post, Proofpoint noted how, like the original, Zloader uses a data structure known as the “BaseConfig” to store its initial configuration. It also deploys several anti-analysis mechanisms to make it hard to detect and reverse-engineer, including junk code, encrypted strings, Windows API function hashing, C&C blacklisting and repetitive obfuscation.

The campaign often uses lures such as warning the user of potential Coronavirus scams, or providing information about testing and treatment centres. They contain downloadable Word files or password-protected Excel sheets containing macros that download and execute the relevant version of Zloader.

Since 2006, 25 versions of the malware have been observed, but the current one appears to be a variation of one of the older versions, rather than the recent one in 2016-18. According to Proofpoint, the Zeus banking malware and its descendants have been a staple of the cyber crime landscape since 2006.

News by Andy Rixon, created 26 May, 2020

Share on
Find what you need
Looking for something specific?
Author Information

Andy Rixon

I am a kind individual that has high ambitions, sometimes too high if you ask me, but that doesn't stop me from trying to do the best that I can in life.

I enjoy a number of things, including but not limited to - gaming and web development.

For more information...
View Profile

© 2021 Andy Rixon
All images are copyright to their respective owners

Made with by VibeCMS
Follow on