ZeroAccess Part 2: What does it do?

First off, sorry this took so long. It is finals week so I have been quite busy.

Overview


ZeroAccess will install 2 different versions of itself depending on the system architecture (32 or 64 bit). Once it has dropped the correct version, and elevated it's privileges, it starts talking with other infected machines to get  instructions. Most of the time, it is used to "Sell Installs". That is, other "hackers" can pay someone to install their virus onto the already infected machines. One of the most popular viruses that is installed with ZeroAccess is Zeus (see Zeus Continues to Evolve and New Variant of Zeus includes Ransomeware). Once that is installed, the "hacker" can steal your personal data including, but not limited to, your credit card number, login credentials to different sites (including banking sites) etc.

Installation

• 32 bit
• When file dropper is executed, it checks whether it is on a 32 or 64 bit computer, then installs the corresponding kit. If it is on a 32 bit machine, it drops a kernel mode or Ring-0 rootkit. It drops itself into a hidden folder. It adds itself to startup, and checks it's list of predetermined C&C (Command and Controls). it then attempts to connect to them on TCP port 13620 and awaits commands.
• 64 bit
• The 64 bit version of ZeroAccess does not have a Ring-0 rootkit. It does, however, have a Ring-3 or User-mode kit. When initiated, it attempts to raise it's privileges as described in part 1. Once that is done it protects its process (makes it harder to kill) and waits for commands.

Communication

The virus comes with a list of known IPs of infected machines. If these machines have UPNP enabled and the ports are properly opened, they become server nodes. If not, then they are just clients. Once it has succesfully made a connection, it is added to the other bots list, and updates its own list. It then periodically checks in with the other servers to see if any new commands were issued. The bot uses TCP port 13620 to connect to others. All communication is encrypted with RC4 encryption. 

Monetizing

The virus is most commonly used to install other viruses like Zeus. It also downloads a click fraud virus. This virus is almost always seen with ZeroAccess, so it is thought that it may be authored by the creator of ZeroAccess. And finally, it downloads a spam bot. This is a virus that is used to send spam, junk, or infected links via e-mail.

Conclusion

This is a very sophisticated piece of malware, and while it may not yet be on par with the TDL family, it is definitely getting there. While it is already dangerous now, imagine what it could become capable in 5 or 10 years from now. As soon it is detected, this must not be ignored. the only way to stop it effectively is to completly remove it from the system. While it is currently only used to download malware to monetize, this could and most likely will change as the owner rents out space and allows other files to be downloaded.

Credits to McAfee labs, Sophos, and PrevX