Kneber is the new Zbot/Zeus

Security blogger Brian Krebs on Friday wrote a column on the spreading infections from the Kneber botnet, which apparently caught a lot of peoples' eyes. The question has come up �does VIPRE protect me against Kneber?�

Kneber is simply a name that Netwitness gave to a variant of Zbot (also called Zeus.) It is not new. Our detections for some of the earliest variants date back to late 2006.

VIPRE detections for Zbot/Zeus/Kneber have been in place for some time. They actually are very good detections -- among the top in the AV industry.

Krebs column here.

Update 02/22:

The DaniWeb site is carrying a story on this that suggests where the name "Kneber" came from:

"The reason some folks have nicknamed it Kneber is that the malware domains involved in this particular branch of the Zeus botnet have �Hilary Kneber� listed as the domain registrant. Of course, Hilary Kneber is likely a completely made-up name" comments Mary Landesman, senior security researcher at ScanSafe.

DaniWeb story here.

Update 02/22 12 p.m. EST

Here are some more good details about the Kneber/Zbot/Zeus history from Dancho Danchev on ZDNet:

01. Why the name Kneber botnet?

The name Kneber comes from the email used to register the initial domain, used in the campaign - HilaryKneber@yahoo.com. What�s particularly interesting about this email, is the fact that it was also profiled in December, 2009�s �Celebrity-Themed Scareware Campaign Abusing DocStoc� analysis, linking it to money-mule recruitment campaigns back then.

02. My time is precious. In short, what is the Kneber botnet at the bottom line?

It�s a mini Zeus crimeware botnet, one of the most prevalent malicious software that successfully undermining two-factor authentication on the infected hosts (Report: 48% of 22 million scanned computers infected with malware), and is slipping through signatures-based antivirus detection (Modern banker malware undermines two-factor authentication) due to the systematically updated binaries.

Story here.

-- Tom Kelchner