• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Malware   »   Going Solo: Self-Propagating ZBOT Malware Spotted

Going Solo: Self-Propagating ZBOT Malware Spotted

  • Posted on:June 10, 2013 at 10:22 pm
  • Posted in:Malware
  • Author:
    Abigail Pichel (Technical Communications)
1

Who says you can’t teach old malware new tricks? Recently, we reported on how ZBOT had made a comeback of sorts in 2013; this was followed by media reports that it was now spreading via Facebook. Now, we have spotted a new ZBOT variant that can spread on its own.

This particular ZBOT variant arrives through a malicious PDF file disguised as a sales invoice document. If the user opens this file using Adobe Reader, it triggers an exploit which causes the following pop-up window to appear:


Figure 1. The error message upon execution of the malicious PDF file

While this is going on, the malicious ZBOT variant – WORM_ZBOT.GJ – is dropped onto the system and run. It is here that several differences start to appear.

First of all, WORM_ZBOT.GJ has an autoupdate routine: it can download and run an updated copy of itself. Secondly, however, it can spread onto other systems via removable drives, like USB thumb drives.

It does thus by searching for removable drives and then creating a hidden folder with a copy of itself inside this folder, and a shortcut pointing to the hidden ZBOT copy.

Figure 2. WORM_ZBOT.GJ Infection Chain

Figure 3. Portion of WORM_ZBOT.GJ code creating copy of itself

This kind of propagation by ZBOT is unusual, to say the least. ZBOT malware is usually distributed by exploit kits and/or malicious attachments. This kind of behavior from ZBOT is not something we’d usually expect to see; it could mean an increase in ZBOT infections moving forward. This unusual behavior, however, is in line with our 2013 predictions, which noted that we believed that older threats would continue to be seen in 2013, although they would have refinements to make them more effective. In the past, some ZBOT variants have used unusual means – like file infectors – to spread as well.

These threats are some of the newest changes to the crimeware landscape; we earlier documented this particular threat in the paper The Crimeware Evolution. Neither propagating via removable drives nor auto-updating are particularly novel; many malware threats have used these behaviors in the past. Most notably, the Conficker/DOWNAD threat used both of these quite effectively; to this day it is a significant threat. It’s still in the top 10 malware in the Americas and Carribean in 2012, despite it being several years old.

We protect Trend Micro users by detecting WORM_ZBOT.GJ, as well as as blocking websites related to this threat. We will provide additional information if necessary to protect our users.

With analysis from Threat Response Engineers Joie Salvio and Alvin Bacani

Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»
Tags: banking malwarebanking virusinformation theftMalwareTrojanZBOTZeuS

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2018

  • Attackers are banking on network vulnerabilities and inherent weaknesses to facilitate massive malware attacks, IoT hacks, and operational disruptions. The ever-shifting threats and increasingly expanding attack surface will challenge users and enterprises to catch up with their security.
    Read our security predictions for 2018.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Necurs Evolves to Evade Spam Detection via Internet Shortcut File
  • Monero-Mining RETADUP Worm Goes Polymorphic, Gets an AutoHotKey Variant
  • XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing
  • XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner

Popular Posts

  • New MacOS Backdoor Linked to OceanLotus Found
  • Monero-Mining HiddenMiner Android Malware Can Potentially Cause Device Failure
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner
  • ChessMaster Adds Updated Tools to Its Arsenal
  • Not Only Botnets: Hacking Group in Brazil Targets IoT Devices With Malware

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.