Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Zberp: New Trojan Created From Leaked Zeus, Carberp Source Code

Security researchers from Trusteer have been monitoring a new Trojan which they’ve dubbed Zberp, and is a combination between Zeus and Carberp families of malware.

Security researchers from Trusteer have been monitoring a new Trojan which they’ve dubbed Zberp, and is a combination between Zeus and Carberp families of malware.

The source code for the notorious Zeus banking Trojan was leaked back in 2011 and the source code for Carberp was put up for sale on Russian cybercrime forums in June 2013.

Researchers knew it would only be a matter of time until malware developers combined the two threats. Trusteer experts first spotted Zberp a few weeks ago when they noticed that cybercriminals were using the Andromeda botnet to download this hybrid malware.

According to the researchers, Zberp si actually a variant of Zeus VM, but its behavior is also similar to versions of the Carberp Trojan family.

The new Trojan enables cybercriminals to perform various tasks, including harvesting system information and taking screenshots. It can also be utilized to steal FTP and POP account credentials, user SSL certificates, and data submitted to HTTP forms.

The Trojan also comes with some optional features designed for web injections, dynamic web injections, man-in-the-middle (MitM) and man-in-the-browser (MitB) attacks, and VNC/RDP connections.

To ensure that their creation is not easy to identify and remove, the developers of Zberp have incorporated several evasion techniques taken from both ZeuS and Carberp.

For example, Zberp relies on a clever trick seen in Zeus VM to ensure it’s persistent. The threat deletes its registry entries when the operating system starts. This way, it’s not detected by security solutions during normal system scans. However, when the infected computer is shut down, the persistence key is written back into the registry.

Advertisement. Scroll to continue reading.

Also similar to Zeus VM, Zberp uses steganography to embed configuration code into an innocent-looking image file. The use of steganography was observed by researchers even before Zeus VM. However, malware developers continue to rely on this technique since it can be an efficient way to evade anti-malware solutions.

From Carberp, Zberp borrows a “hooking” technique. This is used not only to control web browsers and steal information, but also to help the threat evade protection software. In order to ensure that solutions capable of detecting Carberp would not identify Zberp, the hook is implemented differently. It’s in the same place, but one “push” instruction has been moved by one byte and a new “mov” instruction has been added.

The Trojan is also capable of evading detection by using SSL to encrypt communications with the command and control server. Most antivirus engines from VirusTotal did not recognize the threat when it was first detected. However, most modern anti-malware solutions that rely on more than just signatures should be able to detect Zberp.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.