Zberp: New Trojan Created From Leaked Zeus, Carberp Source Code

Security researchers from Trusteer have been monitoring a new Trojan which they’ve dubbed Zberp, and is a combination between Zeus and Carberp families of malware.

The source code for the notorious Zeus banking Trojan was leaked back in 2011 and the source code for Carberp was put up for sale on Russian cybercrime forums in June 2013.

Researchers knew it would only be a matter of time until malware developers combined the two threats. Trusteer experts first spotted Zberp a few weeks ago when they noticed that cybercriminals were using the Andromeda botnet to download this hybrid malware.

According to the researchers, Zberp si actually a variant of Zeus VM, but its behavior is also similar to versions of the Carberp Trojan family.

The new Trojan enables cybercriminals to perform various tasks, including harvesting system information and taking screenshots. It can also be utilized to steal FTP and POP account credentials, user SSL certificates, and data submitted to HTTP forms.

The Trojan also comes with some optional features designed for web injections, dynamic web injections, man-in-the-middle (MitM) and man-in-the-browser (MitB) attacks, and VNC/RDP connections.

To ensure that their creation is not easy to identify and remove, the developers of Zberp have incorporated several evasion techniques taken from both ZeuS and Carberp.

For example, Zberp relies on a clever trick seen in Zeus VM to ensure it’s persistent. The threat deletes its registry entries when the operating system starts. This way, it’s not detected by security solutions during normal system scans. However, when the infected computer is shut down, the persistence key is written back into the registry.

Also similar to Zeus VM, Zberp uses steganography to embed configuration code into an innocent-looking image file. The use of steganography was observed by researchers even before Zeus VM. However, malware developers continue to rely on this technique since it can be an efficient way to evade anti-malware solutions.

From Carberp, Zberp borrows a “hooking” technique. This is used not only to control web browsers and steal information, but also to help the threat evade protection software. In order to ensure that solutions capable of detecting Carberp would not identify Zberp, the hook is implemented differently. It’s in the same place, but one “push” instruction has been moved by one byte and a new “mov” instruction has been added.

The Trojan is also capable of evading detection by using SSL to encrypt communications with the command and control server. Most antivirus engines from VirusTotal did not recognize the threat when it was first detected. However, most modern anti-malware solutions that rely on more than just signatures should be able to detect Zberp.