Son of Zeus can sneak past antivirus controls

Powered by SC Magazine
 

The latest Trojan horse proves difficult to rein in.

Trend Micro has reported that a new variant of the Zeus Trojan is unlikely to be detected by conventional antivirus applications.

In fact, it has proved to be virtually undetectable.

The Zeus Trojan has proved to be a persistent threat and was responsible for the recent £6 million (AU$9.7 million) theft from UK bank accounts by an international gang. This latest evolution of the Trojan means more financial misery could be happening, with computer users unaware their PC had been involved.

The latest variant has been given the typically ungainly name TSPY_ZBOT.BYZ. It has avoided detection by importing a large number of application programming interfaces (APIs), making it difficult to know where it would strike.

The new Zeus is also compressed differently to its predecessors, which foils a detection system based on calculable entropy. This is finding where in the viral code certain trigger routines might be hidden. It has enabled the Trojan to fool the heuristic detection systems in antivirus protection systems.

In addition to these features, analysing the virus has proved difficult for the numerous labs that develop counter measures. Normally, a virus is isolated in a sandbox, or isolated environment, to see how the code executed, what system changes it made and any network traffic it generated. Zeus just refused to play in a sandbox, Trend Micro claimed.

Since the appearance of Zeus.BYZ, another variant, Zeus.SMEQ, has been found and, given the difficulty in detection, there may have been more added to the family.

Trend and its peers, have been working on a detection process.

Julius Dizon, research engineer at Trend Micro, concluded: “To properly guard against this threat, conventional antivirus is not sufficient. Both improved detection techniques and proactive blocking of the websites, working together, can protect users.”

This article originally appeared at itpro.co.uk

Copyright © ITPro, Dennis Publishing


Son of Zeus can sneak past antivirus controls
 
 
 
Top Stories
Westpac interim CIO resigns
Group CIO yet to be appointed.
 
Five emerging technologies that will transform financial services
[Blog post] Far out ideas that aren't far off.
 
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  27%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  23%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 910

Vote