{"id":6400,"date":"2017-01-26T12:10:51","date_gmt":"2017-01-26T20:10:51","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/26\/news-237\/"},"modified":"2017-01-26T12:10:51","modified_gmt":"2017-01-26T20:10:51","slug":"news-237","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/26\/news-237\/","title":{"rendered":"Zbot with legitimate applications on board"},"content":{"rendered":"

Source code of the infamous ZeuS malware leaked in 2011<\/a>. Since that time, many cybercriminals has adopted it and augmented with their own ideas. Recently, among the payloads delivered by exploit kits, we often find Terdot.A\/Zloader<\/strong> – a downloader installing on the victim machine a ZeuS-based malware.<\/p>\n

The payload is very similar to the malware described in this article and references under the name Sphinx (read more here<\/a>). However, after consulting with other researchers (special thanks to Matthew Mesa<\/strong><\/a>), we got proven that the bot that is sold as Sphinx is very different (sample<\/a>). Since there are many confusions about the naming, we decided to stick to the name Terdot Zloader\/Zbot.<\/p>\n

In this post we will have a look at the features and internals of this malware. As we will see, the dropped package consists not only of malicious files –\u00a0 but also legitimate applications, used for the malicious purpose.<\/p>\n

Analyzed sample<\/h3>\n

d45b8a20a991acd01d2ff63735fc1adf<\/a> – original executable #1<\/p>\n

950368afb934fd3fd5b2d4e6704b757b<\/a> – original executable #2<\/p>\n

fca092aca679edd9564d00e9640f939d<\/a> – original executable #3<\/p>\n