Attackers Improve Zeus Trojan to Beat Security
Malware authors have released a new version of the Zeus crimeware, security researchers reported.
The latest version of Zeus, which Trusteer is calling 2.1, has improved the Trojan's business logic as well as its ability to avoid detection by anti-virus. The myriad of enhancements run the gamut from a 1024-bit RSA public key (which will probably be used for one-way encryption of data and authenticating the command and control server to Zeus clients) to URL matching based on a full implementation of the Perl Compatible Regular Expressions (PCRE) library.
Zeus 2.1 also has a fine-grained "grabbing" mechanism based on PCRE that can extract specific areas of the page and report them to the command and control host. The grab mechanism provides an efficient way of collecting user data (such as account balance), as opposed to copying the full page. Its injection mechanism uses sophisticated regular expressions based on PCRE as well.
