ZeuS crimeware now armed with Windows-like piracy controls

The newest version of the ZeuS Builder kit, used to create the troublesome ZeuS banking Trojan, now incorporates sophisticated anti-piracy controls similar to what is used by Microsoft's Windows operating system. Ironically, this might actually be a good thing, given that earlier versions of ZeuS Kits were heavily pirated. 

Kevin Stevens, a security researcher with Atlanta-based SecureWorks described how the ZeuS Builder kit will generate a hardware ID based on various components found in the PCs, including the operating system's version number. The unique ID is sent back to the maker of the ZeuS Builder kit, who will use it to create a product activation code necessary for using the toolkit on that specific workstation.

For a rough idea of the incentive to incorporate such sophisticated controls into a malware creator: The basic, bare-bones ZeuS Builder kit retails for between $3,000 and $4,000, with many add-ons available. 

For example, enabling functionality for the attacker to connect back to the infected computer costs $1,500, while a form grabber for Firefox will be another $2,000. Support for infecting Windows 7/Vista operating systems? That's another $2,000 for the maker of ZeuS. Meanwhile, the ability to connect via VNC (Virtual Network Computing) comes at a premium of $10,000, likely due to how it can allow fraud control measures to be defeated.

In fact, the report noted that version 1.4 of ZeuS is currently being beta tested, and will come with the ability for polymorphic encryption. This means that every infection could result in a unique signature for antivirus software, which will surely make it much harder for them to be detected. You got another $10,000 to spare for this module?

Additional details pertaining to ZeuS can be found in the full-length ZeuS Banking Trojan Report here, authored by Kevin Stevens and Don Jackson.

For more on this story:
- check out the article at Computerworld
- check out the article at The Register 

Related Articles:
New botnet a threat to your systems?
The growing problem of banking Trojans
Rogue malware is money spinner for scammers