New ZeuS Banking Trojan Targets 64-Bit Systems, Leverages Tor

Change is in the wind on malware's Mount Olympus: The notorious ZeuS Trojan is now armed with a 64-bit version that uses the Tor network to communicate with its command-and-control infrastructure.

"The more people switch to 64-bit platforms, the more 64-bit malware appears," blogs Kaspersky Lab researcher Dmitry Tarakanov. "We have been following this process for several years now."

It's a new twist for ZeuS, to be sure, but also a confusing one because 64-bit browsers are not widely used by the public.

"ZeuS is mostly intended to intercept data passing through browsers and modify that data, allowing the operator to steal information related to online banking, to wire transactions, or to cover his tracks," Tarakanov writes. "But nowadays people still use 32-bit browsers -- even on 64-bit operating systems. So 32-bit versions of ZeuS have been sufficient to keep the thieves satisfied with their earnings."

Fortinet's Richard Henderson agreed, calling 64-bit malware "very uncommon." The real question, however, is how long it will be until it is not the exception, but the norm.

"Typically, malware is written in order to cast as wide of a net as possible, and that means sticking with what has the greatest chance of capturing the largest number of infections," says Henderson, security strategist for Fortinet's FortiGuard Threat Research and Response Labs. "Win32 64-bit Windows still run 32-bit applications, and as the analysis mentioned, the vast majority of 64-bit Windows users are still running 32-bit Internet browsers. It’s also the main reason why we don’t see a lot of Mac malware in the wild -- the number of computers out there running 32-bit Windows or 64-bit Windows with the ability to run 32-bit software is orders of magnitude larger."

The 64-bit version of the malware has been in the wild for at least six months. According to Kaspersky Lab, the 64-bit version was actually found inside a 32-bit ZeuS sample that injected malicious code into target processes and injected the 64-bit version into the process as if it belonged to a 64-bit application. If the process belongs to a 32-bit application, then the malware pushes the 32-bit version.

The 64-bit version behaves like any other variant of ZeuS, installing files into folders with randomly generated names placed inside of the %APPDATA% directory.

"Interestingly, the configuration file for this version of ZeuS includes a long list of programs that the malware can function on if they are found on the infected system," Tarakanov blogs. "There are different types of programs, but all of them contain valuable private information that cybercriminals would love to steal -- login credentials, certificates and so on. Don’t forget that ZeuS is capable of intercepting key strokes and data before encryption/after decryption that is sent/received on a network with the use of some typical system API functions. So, when operating inside these programs ZeuS is able to intercept and forward a lot of valuable information to the botnet operator."

In addition to the 64-bit component, this version of ZeuS maintains a tor.exe utility from the 0.2.3.25 version inside its body, he adds.

"Tor.exe is launched indirectly -- ZeuS starts the system svchost.exe application in suspended mode, then injects the tor.exe code into this suspended svchost.exe process, tunes the code to run properly and resumes execution of the suspended svchost," Tarakanov explains. "As a result, instead of the system svchost.exe, the process actually starts executing tor.exe. The Tor utility under the cover of the svchost.exe process creates an HTTP proxy server listening to the TCP port 9050."

ZeuS variants using Tor, however, is nothing new; in actuality, Kaspersky Lab has tracked samples with signs of Tor communications as far back as 2012. Step-by-step instructions are even on the Internet on how to use tor.exe to pass ZeuS or SpyEye traffic via the Tor network, as well as how to create onion domain hosting for command-and-control for these banking Trojans.

"But these earlier samples mostly had CnC [command and control] domains specified in their bodies as localhost or 127.0.0.1 meaning that samples of ZeuS or Spyeye themselves were not tied too strictly with Tor communications, whereas the version of ZeuS described [here]…has CnC onion domain egzh3ktnywjwabxb.onion defined in its internal block of settings," the Kaspersky researcher notes. "And tor.exe is included directly in its body and is run by ZeuS itself. So Tor communications and the 64-bit version are inseparable parts of this ZeuS sample, with the functionality included at the very development stage."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.