ZeroAccess Part 1: What is it

ZeroAccess is quickly becoming one of the go to rootkits, and may surpass the TDL family in the coming years. Machines are most commonly infected using 2 techniques, the first being through an exploit kit, the second being Social Engineering.

BlackHole Exploit Pack
Infection Statistics

Let's first take a look at how the exploit kit infection works. First, an Exploit Pack, is a webpage that is designed to exploit software commonly installed on computers, such as Flash, Java, Internet Explorer, etc. It tries to find loopholes to let it silently download and execute a program on the victims computer. Most Exploit Packs use outdated exploits that are already patched, although, a few extremely high-end packs use what are known as "0-Day" exploits. This means that it works for the newest version of exploited software, and is not yet know/detected. To drive traffic to these exploits, "hackers" find holes in legitimate websites, and embed a small code into the pages that will direct the user to their site unknowingly. This is most often done through an "IFrame" set to be 0px wide and 0px high. Since the user does not need to see or interact with the exploit site, this works perfectly. Sometimes a JavaScript is embedded, although this is less common as some web hosts have JavaScript disabled, and it is more noticeable. The exploit then goes through its list of exploits, and, if one is found working, downloads and executes the payload (ZeroAccess).

Figure 1.1

Sometimes, the "hacker" uses Social Engineering techniques to try and get the user to willing download and execute the file. This is usually done by attaching the file to some sort of program crack or keygen. The "hacker" will bind his virus (ZeroAccess) to the crack, and then upload it to a filehost, or torrent host. The user will download and execute this file and, since it works, won't be very suspicious. The "hacker" can also use something called a "Java Drive By". This is more of a mix of exploit and Social Engineering. The "Hacker" sets up a site where there is a browser game or camera that needs Java to run. When the victim goes to the website, he will first be prompted to allow java to run (see Figure 1.1), then he will be asked to download and install an "update". This update, of course, is actually the "hackers" virus. Then, once the user clicks ok, the page will "refresh" and the application that required Java will work. The user, being satisfied that it works, will not suspect a thing.

Figure 1.2

When the virus is executed, it first checks what architecture the computer is (32 or 64). It then drops the related file and dies. Once the file is dropped, if execute on a non-admin account, it will require a UAC popup window . It does this by acting as if it is an official adobe update. It replaces a .dll inside of the adobe installer folder, and prompts the user to download the update (see Figure 1.2). This "update" actually downloads the latest flash player, but also gives the virus admin permissions. It then goes on to connect to other infected computers, and await orders.

Stay tuned for Part 2: What does it do
then later, the final part Part 3: How to stop it

Credits to McAfee labs, Sophos, and PrevX