- Jan 24, 2011
- 9,378
A variant of Zeus banking Trojan found recently by malware analysts emerged totally invisible to antivirus engines at the time of the assessment.
Zeus, also known as Zbot, is well known in the security industry since 2007 and made millions of victims since. Its versatility allowed the creation of Gameover Zeus (GoZ), which captured banking information and was also used to distribute CryptoLocker ransomware.
The activity of both GoZ and Cryptolocker was disrupted in early June 2014, during Operation Tovar, an effort involving multiple law enforcement agencies and private security firms.
Detection is bound to increase quickly
Stephen Ramage from PricewaterhouseCoopers discovered that the latest version of Zeus was delivered via Neutrino exploit kit, a web-based attack tool that takes advantage mostly of unpatched versions of Flash Player browser plugin to funnel in a malicious payload.
The researcher learned that the sample was a variant of Zeus by running it through the analysis platform at Malwr.com, which showed that it created mutexes matching the banking Trojan
Uploading the sample to VirusTotal showed that none of the antivirus products in the collection could identify the piece of malicious.
Things are changed at the moment, as Malwr.com reports that at least one security solution at VirusTotal flags the file.
Read more: http://news.softpedia.com/news/Zeus-Banking-Trojan-Variant-Goes-Completely-Undetected-483474.shtml
