Security researchers have identified a new variant of the Zeus malware, which has fewer features but uses stronger encryption mechanisms to go unnoticed.
Fortinet has analyzed the malware, also known as “Lite Zeus,” in detail. According to security expert Kan Chen, the malware differs from other versions of Zeus, such as Gameover, in terms of network communication, command and control protocol, and encryption techniques.
It is worth noting that Lite Zeus only uses the TCP protocol to communicate with the command and control center (C&C) – to send or retrieve information – and has a number of features and functions, including the ability to cause operating systems to shut down or reboot. Attackers can also modify the botnet at will to carry out additional malicious activities.
Chen revealed that the "Lite" version of Zeus uses AES-128, instead of the older RC4 encryption format.
"As for many variants of Zeus, RC4 has been widely used in data encryption and decryption, due to its fast speed and easy integration. Surprisingly, this variant of Zeus does not use RC4, but implements AES-128 instead."
"After the neutralization of Game Over Zeus, there are many variants of the malware that have temporarily taken over the market, and Lite Zeus is definitely one of them," the researcher pointed out.
