ZeusVM Bits and Pieces Naming Versions

More documents

Recommendations

Info

The encryption algorithm is a basic XOR and can be described in Python like this: Once decrypted, the plaintext base config data structure can be parsed (see later section):
Decrypting the Base Config in ZeusVM The most significant improvement in ZeusVM compared to other versions of Zeus is that instead of decrypting the base config with a simple XOR, it inputs the config to a custom virtual machine that runs and decrypts it. This is where the “VM” in ZeusVM comes from. One way to track down the virtual machine components in the executable is by searching for PUSH or MOV instructions containing an immediate value of 0x1000 (highlighted in red). This usually returns a number of functions that contain code similar to:
Page 1 and 2: ZeusVM: Bits and Pieces By Den
Page 3 and 4: Within the ZeusVM executable it
Page 5: After extracting the version fr
Page 9 and 10: Next, the handler is implemente
Page 11 and 12: The rough outline of the code
Page 13 and 14: 1. 26 - instr_setedx_SHORT 2. 26
Page 15 and 16: esearchers. Querying ASERT’s 2
Page 17 and 18: This sample has the RC6 key s
Page 19 and 20: Removing the layers of encrypti
Page 21 and 22: The config is encrypted using
Page 23 and 24: This data starts 14 bytes from
Page 25 and 26: Version 2.0.14.0 decrypts the c
Page 27 and 28: While this is only the first
Page 29 and 30: The contents of these extra, f

ZeusVM Bits and Pieces Naming Versions

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?