Tweet

We have been continuously analyzing this new ZeuS “upgrade” known as LICAT (aka Murofet) for some time now. In this update, I will delve on the monitored URLs and domains that LICAT contacts as well as the latest detection names associated with them.

The primary difference between LICAT and ZeuS is LICAT’s capability to contact its server using domains generated based on the current date, particularly the year, month, day, and minute. As expected, a number of the generated domains became active and were found to host new or updated versions of LICAT and ZeuS configuration files. Most of the domains, which became live, resolved to already-known ZeuS IP addresses. Below are some grouped (by resolving IP addresses) generated domains.

The domains above were already used to host encrypted configuration files that LICAT downloads and decrypts for use in its information-stealing routine. The configuration file contains a list of the types of information to be stolen, particularly login credentials for conducting various online transactions, as well as instructions on where to upload these.

Aside from the information-stealing routine the configuration file downloaded from the generated domains, some active domains were also found to host new LICAT or ZeuS malware variants, namely, TSPY_ZBOT.BYZ and PE_LICAT.A-O. The new downloaded samples mostly had different hashes, which are detected via the heuristic detection TSPY_ZBOT.SMEQ. Furthermore, these generated domains can easily be registered by other cybercriminals for use in delivering other malware. This poses a new threat to users and consequently increases the potential for system infection. Indeed, with LICAT’s capability to steal valuable information, it poses a critical threat to user systems and up-to-date virus definitions are a must.

You can find several discussions on this threat in the following blog entries:

• ZeuS’ Response to Automated Analysis
• ZeuS Ups the Ante with LICAT
• File Infector Uses Domain-Generation Technique Like DOWNAD/Conficker

As we continue to monitor this threat, we will post updates on the Malware Blog. In addition, we are currently working on a more in-depth technical paper that will provide details on the intricacies behind the ZeuS-LICAT plot.