Hackers found a new way to slip past security software and deliver Zeus, a long-known malicious software program that steals online banking details.
Security company Malcovery Security, based in Georgia, alerted security analysts after finding that none of 50 security programs on Google’s online virus scanning service VirusTotal were catching it as of early Sunday.
Gary Warner, Malcovery’s chief technologist, posted on his blog an assortment of spam messages, which spoofed brands and organizations such as the payment processor ADP, the Better Business Bureau and the British tax authority HMRC.
The spam messages contain a “.zip” file, which, if opened, contains a small application called UPATRE. That executable file downloads a “.enc” file, which it then decrypts. The decrypted file is GameOver Zeus, a variant of the notorious Zeus malware.
Zeus first appeared in 2006 and has long been a thorn in the side of banks. Its source code was leaked in May 2011, and cybercriminals have continued to make improvements to make its network more resilient, according to Dell’s SecureWorks unit.
Security products are appearing to stumble on the “.enc” file since it doesn’t end in “.exe,” which designates an executable program, Warner wrote.
“Why? Well, because technically, it isn’t malware,” he wrote.
He advised that network administrators check their logs to see if any “.enc” files have been downloaded on their networks. The spam is distributed by the Cutwail botnet, another long-running botnet known for distributing malware.
“It is likely that many different criminals are paying to use this infrastructure,” Warner wrote.