Research

Tracking bugs in Zeus campaigns

Is this malicious campaign familiar to you?

Yes, it’s Zeus (Zbot). If your system is fully patched and you click on the link you won’t get the binary; a special PHP script on sddghdskfgjr.cz.cc won’t release it and you will only get an error message. It’s standard filtering the criminals use for anti-automated malware collection.
The mentioned .cc domain is shorted twice with 2 different short name services. The first one is http://3cm.kz/. Despite the official info of the services (a legitimate one) it has a strange slogan that is really close to the Russian speaking cybercriminals slang “Short your beast”:

I found an interesting “bug” in the malicious .php script on the .cc domain. If you go to the short link with any of the special characters at the end and even if it’s the same system and it’s fully patched, you will get the binary again and again. For example, instead of clicking on http://3cm.kz/example, just put at the end http://3cm.kz/example+ or http://3cm.kz/example* or any other and for each new special char you will get the binary. One special char per one new download. The second short URL service used by the criminals is http://shortn.me

When you check statistics on how many users have been clicking, you will find a big difference between the first shortened URL and the second one:

Tracking bugs in Zeus campaigns

(Clicks on 3cm – only 24 clicks)

Tracking bugs in Zeus campaigns

(Clicks on Shortn – 200 clicks)

Not so many clicks, but we should remember first of all it’s a targeted attack and second that the impact is quiet high. Here the importance it’s not the quantity but the quality.

On the other hand the difference between clicks show the criminals use the Shortnme link as a general one for many targets, while the short link from 3Cm is specially prepared for each particular target (company). This way the cyber criminals can track possibly better infections from each target.

At the moment of download of the malicious sample it was detected by UDS (Cloud technology) of Kaspersky and now it’s detected as Trojan-Spy.Win32.Zbot.bvmv

Tracking bugs in Zeus campaigns

Your email address will not be published. Required fields are marked *

 

Reports

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Andariel evolves to target South Korea with ransomware

In April 2021, we observed a suspicious Word document with a Korean file name and decoy. It revealed a novel infection scheme and an unfamiliar payload. After a deep analysis, we came to a conclusion: the Andariel group was behind these attacks.

Subscribe to our weekly e-mails

The hottest research right in your inbox