Whatsapp and ZEUS message

The ESET Latin America Research Laboratory has detected a sample of a campaign linking WhatsApp and Zeus, one of the most popular threats, specialized in the theft of personal information and banking credentials. The infection is carried out through the receipt of an email that pretends to contain a WhatsApp voice message and has a compressed file attached called Missed-message.zip. When decompressed, an executable with the same name is obtained, which functions as a dropper, a common technique used by attackers to make a file that seems harmless download another threat. Thus, the file executes another malicious code, called budha.exe, which also has the same functionality. In this way, the second dropper starts a process called kilf.exe that has the function of "cleaning" the scene, deleting the files mentioned above thanks to a file with a BAT extension that also deletes itself. Then a second executable appears, the malware behind the Zeus botnet (ZBot) which is detected by ESET solutions as Win32/Spy.Zbot. Throughout the entire cycle, the malware manipulates the sound drivers of the infected operating system, simulating being a real audio file. "These cybercriminals take advantage of the popularity of WhatsApp for their campaign. To avoid being a victim of cases like this, it is important to have a security solution that detects the threat. In addition, we recommend verifying whether the information in question, in this case the voice message, is genuine," commented Raphael Labaca Castro, Awareness & Research Coordinator at ESET Latin America.