Security Experts:

Connect with us

Hi, what are you looking for?



Zberp: New Trojan Created From Leaked Zeus, Carberp Source Code

Security researchers from Trusteer have been monitoring a new Trojan which they’ve dubbed Zberp, and is a combination between Zeus and Carberp families of malware.

Security researchers from Trusteer have been monitoring a new Trojan which they’ve dubbed Zberp, and is a combination between Zeus and Carberp families of malware.

The source code for the notorious Zeus banking Trojan was leaked back in 2011 and the source code for Carberp was put up for sale on Russian cybercrime forums in June 2013.

Researchers knew it would only be a matter of time until malware developers combined the two threats. Trusteer experts first spotted Zberp a few weeks ago when they noticed that cybercriminals were using the Andromeda botnet to download this hybrid malware.

According to the researchers, Zberp si actually a variant of Zeus VM, but its behavior is also similar to versions of the Carberp Trojan family.

The new Trojan enables cybercriminals to perform various tasks, including harvesting system information and taking screenshots. It can also be utilized to steal FTP and POP account credentials, user SSL certificates, and data submitted to HTTP forms.

The Trojan also comes with some optional features designed for web injections, dynamic web injections, man-in-the-middle (MitM) and man-in-the-browser (MitB) attacks, and VNC/RDP connections.

To ensure that their creation is not easy to identify and remove, the developers of Zberp have incorporated several evasion techniques taken from both ZeuS and Carberp.

For example, Zberp relies on a clever trick seen in Zeus VM to ensure it’s persistent. The threat deletes its registry entries when the operating system starts. This way, it’s not detected by security solutions during normal system scans. However, when the infected computer is shut down, the persistence key is written back into the registry.

Also similar to Zeus VM, Zberp uses steganography to embed configuration code into an innocent-looking image file. The use of steganography was observed by researchers even before Zeus VM. However, malware developers continue to rely on this technique since it can be an efficient way to evade anti-malware solutions.

From Carberp, Zberp borrows a “hooking” technique. This is used not only to control web browsers and steal information, but also to help the threat evade protection software. In order to ensure that solutions capable of detecting Carberp would not identify Zberp, the hook is implemented differently. It’s in the same place, but one “push” instruction has been moved by one byte and a new “mov” instruction has been added.

The Trojan is also capable of evading detection by using SSL to encrypt communications with the command and control server. Most antivirus engines from VirusTotal did not recognize the threat when it was first detected. However, most modern anti-malware solutions that rely on more than just signatures should be able to detect Zberp.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.


Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.