Malware Using the Registry to Store a Zeus Configuration File
Summary: Cisco Talos analyzed a malware sample that stores a Zeus configuration file in the Windows registry, writing chunks of data through Advapi32.RegSetValueExW() from threads inside Explorer.exe, with sub-key names like "2f0e9h99" built from a hash of the User SID combined with an index value. The writes cycle between 475-byte binary chunks and alphanumeric (possibly base64) encoded strings, including one 7200-byte write, and the malware checks a 20-byte hash against previously received datagrams before replacing or appending each chunk.
Why it matters: The registry traffic that exposed this sample was only caught because the writes exceeded 3000 bytes and tripped a sandbox alarm, so a configuration hidden in smaller, encoded chunks could sit in a key that changes name between executions without drawing the same attention.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026