ITSecX 2014 Slides Marion Marschalek

1. RISE OF THE BANKING TROJANS
Subtitle Redacted

2. Z... Whatever
Alternative Talk Title

3. ZEUS IS NOT DEAD YET
Actual Talk Title
m/-.-m/
http://www.sodahead.com/

4. Marion Marschalek
@pinkflawd
marion@cyphort.com
http://hqwallbase.com/28103-lego-stormtroopers-wallpaper-2560x1600

5. What is ZEUS?
Old.
Banking Trojan.
Data Stealer.
Open Source :)

7. 2007
2010
2011

8. Source: http://securityblog.s21sec.com

10. ZEUSold but gold
Zeus
Citadel
SpyEye
ZitMo
ZeusVM/KINS
Zberp
http://forum.fr.grepolis.com/

11. ZEUSmode of operation
1.Drop executable in users %APP% folder
2.Create and execute a batch file to delete dropper
3.Maintain registry key for persistence
4.Inject payload to system processes
5.Download customized configuration

12. Registry Key
Infector
Decrypt & load DLL
Inject DLL
ZEUSmode of operation

13. Hell is infected with some dark bastard of zeus hail satan!!

14. E(DDIE)VASIONTECHNIQUES

15. E(DDIE)VASIONtechniques
Weapons of matchdestruction!

16. E(DDIE)VASIONtechniques
Weapons of MATCHdestruction!

17. ZEUSE(DDIE) VASION
%APP%Uwirpa
10.12.2013
23:50
%APP%Woyxhi
10.12.2013
23:50
%APP%Hibyo
19.12.2013
00:10
%APP%Nezah
19.12.2013
00:10
%APP%Afqag
19.12.2013
23:29
%APP%Zasi
19.12.2013
23:29
%APP%Eqzauf
20.12.2013
22:23
%APP%Ubapo
20.12.2013
22:23
%APP%Ydgowa
20.12.2013
22:23
%APP%Olosu
20.12.2013
23:03
%APP%Taal
20.12.2013
23:03
%APP%Taosep
20.12.2013
23:03
%APP%Wokyco
16.01.2014
13:22
%APP%Semi
17.01.2014
16:34
%APP%Uheh
17.01.2014
16:34

18. E(DDIE)VASIONon the system level
OpenProcess
Check AccessToken
WriteProcessMemory
CreateRemoteThread
Boom.

19. Domain
Generation
Algorithms
http://blog.malwaremustdie.org/
E(DDIE)VASIONon the perimeter

20. E(DDIE)VASION
on the binary level

21. E(DDIE)VASION
on the binary level

22. Eddie In The Browser
USER
BANK.COM
BROWSER
inject
web
content
grab
user
input
+

23. •UpdateURL & ConfigBackup URL
•UploadURL
•InjectionInformation
•URL Masks:
•For identifying websites to log
•For identifying websites to screenshot
•URL Mappingsfor Redirection
•IP/URL Mappings to insert to host file to override DNS lookups
CONFIGURATION

24. SUMMING IT UP
DROPPERkilf.exe
C&C SERVER
control communication and updates
DELETE SCRIPT
KUQ9491.bat
ZBOT
vogiap.exe
CONFIGURATIONehri.ofu
drop Zbotfiles
delete dropper
PROCESS
explorer.exe
inject code

25. ZitMoZeus in the Mobile
Zeus Infection
Installation of ZitMo
Social Engineering
Spying of Online-Banking credentials
Capture mTAN
Do Transaction

26. ZeusVM/ KINS
Born December 2011
Sold as a kit since 2013
Heavily based on Zeus source code
http://blog.fox-it.com/2013/07/25/analysis-of-the-kins-malware/

27. Zeus VIRTUAL MACHINE
1. Grab next opcode
2. Call opcode handler

28. INVISIBLE PERSISTENCE
thread for managing autorun key
...

29. CONFIGURATIONhiding in plain sight

30. CONFIGURATIONhiding in plain sight

31. http://blog.malwarebytes.org
https://blog.malwarebytes.org
CONFIGURATIONhiding in plain sight

32. Carberp
There is no honour among thieves:
“Leaking the source code was not like the leaking of a weapon, but more like the leaking of a tank factory”
1.9GB Sources
http://krebsonsecurity.com/

33. ZBERP
+
=
2

34. ZBERP?

35. ZBERP?

36. ZBERP?

37. ZBERP ..?
Infection Routine
Anti-Disassembly
Invisible Persistence
Graphical Configuration
Virtual Machine Execution
Encrypted C&C communication
Suspend-Thread Code Injection
Hooking Technique
ZEUS
KINS
CARBERP

38. BRAVE NEW WORLD
NOW WHAT ABOUT DETECTIONS?

39. HUNTING ZEUS
1.Drive-by infections
2.Anomalies in network traffic
3.Threat intelligence feeds to follow C&Cs
4.File system & registry key changes
5.Watch your data

40. malware Killchain
Awareness | Behavior | Correlation | Intelligence | Encryption
LURE
EXPLOIT
INFECT
CALL
HOME
STEAL
DATA

41. RESOURCES
•Eddie Sources:
•http://www.guitarworld.com/photo-gallery-many-faces-iron-maidens-eddie
•http://maiden-world.com/articles/history-of-eddie.html
•http://ultimateclassicrock.com/iron-maiden-eddie-album-covers-retrospective/
•http://www.cyactive.com/zberp-baby-super-trojan/
•https://blog.malwarebytes.org/security-threat/2014/02/hiding-in-plain- sight-a-story-about-a-sneaky-banking-trojan/
•http://www.fortiguard.com/legacy/analysis/zeusanalysis.html
•http://www.symantec.com/connect/blogs/brief-look-zeuszbot-20
•http://www.reuters.com/article/2007/07/17/us-internet-attack- idUSN1638118020070717

42. https://sunchaser.info/fun/ed-force-one.html
Thank you
marion@cyphort.com
@pinkflawd