ZLoader Malware Evolves with Anti-Analysis Trick from Zeus Banking Trojan
The fact that the creators of the resurrected ZLoader malware included a function that was initially found in the banking trojan Zeus suggests that the malware is still under active development.
According to a technical study by Zscaler ThreatLabz researcher Santiago Vicente, the most recent version, 2.4.1.0, adds a functionality to stop execution on machines that are different from the original infection. "The leaked Zeus 2.X source code included a similar anti-analysis capability, although it was built differently.
ZLoader, also known as Terdot, DELoader, or Silent Night, was taken down in early 2022 then resurfaced in September 2023, almost two years after it had been absent.
Updates to the malware's domain generation algorithm (DGA) and the addition of RSA encryption have mad...