Security researchers from Trend Micro have identified an interesting malware distribution campaign. Cybercriminals are using the Patnote (Pioneer) virus to spread ZeuS (Zbot).
When the Patnote file is launched, it adds code to all executable files, including removable network drives. This code is designed to execute the embedded version of ZeuS (TSPY_ZBOT.PNR) in the “User Temp” folder and infect other executable files.
The fact that Patnote spreads to multiple systems makes the threat more difficult to remove. It also allows ZeuS to infect networks with limited internet access.
It is worth noting that Patnote uses some mechanisms that prevent researchers from analyzing it. It is designed to stop working if analysis tools, such as StudPDE, ProcDump, Ollydbg or WinHex, are detected.
To protect your system from this threat, avoid clicking on suspicious links and always keep your antivirus software up to date.
