Decoding Domain Generation Algorithms (DGAs) Part II - Catching Zeus Bot Injection into Explorer.exe
Summary: Cisco Talos analyzed a ZeusBot sample that injects code directly into memory rather than loading a DLL via LoadLibrary, using OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The sample injects itself into every process in the process list except itself, performing different functionality depending on the target process, and the researcher describes an approach to catch the injected code paused at its entry point inside explorer.exe.
What you should know: Because the injected code runs inside explorer.exe without a dropped DLL, the technique leaves no file for signature-based tools to catch, and the same binary behaves differently depending on which process it lands in.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026