View source for New IceIX (ZeuS variant) changes its encryption method (again)

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.tidos-group.com/blog/?p=447 www.tidos-group.com
|Author=Andreas Baumhof, 
|NomRevue=TrustDefender Labs blog
|Date=20 octobre 2011
|Editor=TrustDefender Labs
|Year=2011
|ISBN=
|Page=
|Abstract=In our last in-depth report we looked at enhancements of the notorious ZeuS trojan that focus solely on making life harder for automated detection tools and tracking software. We looked at three variants that are based on the leaked source code. The fear is that a proliferation of too many different variant will make life harder to detect and track the various trojans.<br/>

One of the variants is called IceIx and on October 13 we noticed the presence of a new in-the-wild IceIx ZeuS variant. We therefore decided to take a brief look. The sample had a size of 169,984 bytes and an MD5 of ed34b46a4524c7d05e45200eaf09f765. It contained exactly the same number of routines at the previous variant, 634. There were minor changes to around 20 of the routines, the rest were unchanged.<br/>

As you’ll see below, the changes are minimal, but the result is that all automatic decyrption routines will fail!<br/>

Well, it seems that the bad guys continue to “tweak” the encryption algorithm and the arms race continues up until we finally implement some proactive solutions rather than reactive countermeasures.
|Botnet=IceIX, ZeuS, 
|Malware=, 
|CCProtocol=, 
|Operation=, 
}}