Terdot: Zeus-based malware strikes back with a blast from the past

Malware authors are surely known for their ability to fly under the radar. But every once in a while, details about their operations surface on the web. This is the case of a handful of malware operations that managed to gain unwanted attention by having their source code leaked. Mirai, KINS, Carberp and Zeus are among the malware families that went “open-source”, either voluntarily or because of operational negligence. And when this happens, high-quality code is rapidly adopted and integrated by less-skilled criminal groups looking for shortcuts to financial success.

Particularly interesting about Terdot, though, is that, just like the Netrepser targeted attack, it leverages legitimate applications such as certificate injection tools for nefarious purposes, rather than specialized utilities developed in house. Another discovery worth mentioning is that, even if Terdot is technically a Banker Trojan, its capabilities go way beyond its primary purpose: it can also eavesdrop on and modify traffic on most social media and email platforms. Its automatic update capabilities allow it to download and execute any files when requested by its operator, meaning it can develop new capabilities.

This whitepaper is a technical analysis of the Terdot, a Banker Trojan that derives inspiration from the 2011 Zeus source code leak.

Download the whitepaper