We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,108 News Articles

New version of Gozi financial malware bundles MBR rootkit

The malware installs code into the computer's master boot record in order to achieve persistence, Trusteer researchers say

Researchers from security firm Trusteer have found a new variant of the Gozi banking Trojan program that infects a computer's Master Boot Record (MBR) in order to achieve persistence.

The Master Boot Record (MBR) is a boot sector that resides at the beginning of a storage drive and contains information about how that drive is partitioned. It also includes boot code that runs before the operating system starts.

Some malware authors have leveraged the MBR in order to give their malicious programs a head start over antivirus programs installed on the computer.

Sophisticated malware that uses MBR rootkit components, like TDL4, also known as Alureon or TDSS, are part of the reason why Microsoft built the Secure Boot feature into Windows 8. This malware is hard to detect and remove and can even survive operating system reinstallation procedures.

"Even though MBR rootkits are considered highly effective they haven't been integrated into a lot of financial malware," Trusteer researcher Etay Maor said Thursday in a blog post. "One exception was Mebroot rootkit that was used to deploy Torpig (aka Sinowal/Anserin)."

The new Gozi MBR rootkit component waits for Internet Explorer to be launched and then injects malicious code into the process. This allows the malware to intercept traffic and perform Web injections inside the browser like most financial Trojans programs do, Maor said.

The fact that a new variant of Gozi was discovered shows that cybercriminals continue to use this threat despite the fact that its main developer and some of his accomplices were arrested and indicted.

The new variant detected by the Trusteer researchers is very similar to an older version, except for the additional MBR rootkit component, Maor said. "This may indicate that a new rootkit is being sold in the cybercriminals' forums and is adopted by malware authors."

While some dedicated tools for removing MBR rootkits do exist, many experts recommend wiping the entire hard drive and recreating the partitions in order to ensure a clean start if the computer has been infected with such a threat, Maor said.

Since cleaning such malware might require advanced technical knowledge, it's probably best to contact the technical support department of your antivirus provider in order to get expert help.


IDG UK Sites

Windows 9 release date, price, features: Microsoft teases new OS ahead of 30 September unveiling

IDG UK Sites

From the iPhone 6 to the iWatch and a new Apple TV we look at the products Apple is set to launch...

IDG UK Sites

September 2014 creative trends: 5 things you must see

IDG UK Sites

What to expect from Apple in autumn/winter 2014: iPhone 6, iPhone Air, iWatch, iPad 6, new Apple...