ZLoader Malware

Overview

The ZLoader malware, also known as Terdot, DELoader, or Silent Night, has recently undergone significant updates, enhancing its capabilities and evading detection mechanisms. Originally derived from the Zeus banking trojan, ZLoader has evolved to support a broader range of malicious activities, including the distribution of ransomware.

Recent Developments

As of early 2024, new variants of ZLoader have been identified, specifically versions 2.1.6.0 and 2.1.7.0, which incorporate advanced techniques to thwart analysis and enhance persistence:

1. 64-bit Compatibility: The latest ZLoader variants are now compatible with 64-bit Windows systems, broadening the potential target base for cybercriminals​ (ANY.RUN Sandbox)​​ (RedPacket Security)​.
2. Enhanced Encryption and Obfuscation:
   • RSA Encryption: The malware uses RSA encryption to protect its configuration data, replacing the older RC4 encryption method​ (RedPacket Security)​​ (Tanium)​.
   • Domain Generation Algorithm (DGA): Updates to the DGA enhance resilience against domain takedown efforts by enabling the malware to generate backup communication channels​ (Tanium)​.
3. Anti-Analysis Features:
   • Junk Code and String Obfuscation: These techniques are utilized to complicate reverse engineering and automated analysis processes​ (ANY.RUN Sandbox)​.
   • Execution Requirements: ZLoader now requires a specific filename to execute, potentially evading detection by systems that alter filenames​ (RedPacket Security)​​ (Vumetric Cybersecurity)​.
4. Network Communications: The updated ZLoader variants continue to use HTTP POST for C2 communications but now include a combination of RSA and the Zeus "visual encryption" algorithm for enhanced security​ (Tanium)​.

Threat Landscape

ZLoader's comeback is part of a larger trend of cyber threats that are becoming more sophisticated and harder to detect. The operational takedown in 2022 significantly disrupted ZLoader's activities but did not eliminate the threat group behind it. Recent campaigns indicate that ZLoader could be a precursor to more severe ransomware attacks, particularly due to its enhanced loader capabilities and the shift towards using more complex encryption and communication strategies.

Recommendations for Mitigation

1. Endpoint Security: Ensure that all endpoint security solutions are up-to-date with the latest signatures and definitions to detect and block the execution of malicious files associated with ZLoader.
2. Network Segmentation and Monitoring: Implement stringent network segmentation and monitor network traffic for unusual activity associated with the IoCs listed.
3. User Training: Continuously educate users on the risks of phishing and the importance of not engaging with unsolicited emails or clicking on unknown links.
4. Regular Audits: Conduct regular security audits and vulnerability assessments to identify and mitigate potential entry points for malware.

Indicators of Compromise (IoCs)

To aid in the detection and mitigation of the ZLoader malware, the following IoCs have been identified. Organizations should update their security systems to detect these indicators, which are associated with the latest versions of ZLoader:

SHA256 Hashes:

• cba9578875a3e222d502bb6a85898939bb9e8e247d30fcc0d44d83a64919f448
• 85962530c71cd31c102853d64a8829f93b63bd1406bdec537b9d8c200f8f0bcc
• b1a6bf93d4ee659db03e51a3765d4d3c2ee3f1b56bd9b701ab5939d63f57d9ee
• 85b1a980eb8ced59f87cb5dd7702e15d6ca38441c4848698d140ffd37d2b55e6

Malicious URLs (defanged):

• https://eingangfurkunden[.]digital/
• https://citscale[.]com/api.php
• https://adslsdfdsfmo[.]world/
• https://gycltda[.]cl/home/wp-api.php

These IoCs can be utilized within security tools such as SIEM systems, endpoint detection and response (EDR) solutions, and network traffic analysis tools to help identify potential infections of ZLoader in organizational networks.

Sources

Zloader Learns Old Tricks (ZScaler)

ZLoader Malware Evolves with Anti-Analysis Trick from Zeus Banking Trojan (The Hacker News)

ZLoader malware resurfaces with anti-analysis feature (Cybersecurity Help)

Conclusion

The updates to ZLoader's capabilities and the ongoing efforts by threat actors to enhance their malware underline the necessity for continuous vigilance and proactive defense strategies in cybersecurity. By integrating these IoCs into their security monitoring tools, organizations can better position themselves to detect and respond to ZLoader infections, potentially preventing further damage or data loss.