ZITMO (ZeuS-in-the-Mobile, ZeuS Mitmo)

• 30 samples
• ZITMO is confusing. More research is required, but here are some notes:
  • I haven't been able to find any hash or C2 IOCs in any of the references
  • I haven't been able to find the config file containing the webinjects referenced
  • It is likely that the novel "ZITMO" features are more webinject related rather than malware related
  • "In order to download the configuration file it added X-Tag/53F54B2D in the User-Agent header" [270]
  • "The ZeuS binary related to this new configuration file was a version 2.0.8.11..."[270]
  • There might be a linkage with Unnamed 2. ZITMO version 2.0.8.11 contains a "X-Tag/53F54B2D" string, but also uses "ajax.aspx?v=3" style URIs
• Based on the ZITMO version 2.0.8.0 reference sample deep dive:
  • 484 functions
  • 178 encrypted strings
  • The C2 is stored in an encrypted BaseConfig using XOR
  • The DynamicConfig is encrypted using RC4 and "visual decrypt"
  • 24 commands

References (13)

• 2010-09-25: ZeuS Mitmo: Man-in-the-mobile (I) [222]
• 2010-09-25: ZeuS Mitmo: Man-in-the-mobile (II) [223]
• 2010-09-25: ZeuS Mitmo: Man-in-the-mobile (III) [224]
• 2010-09-27: Zeus In The Mobile (Zitmo): Online Banking’s Two Factor Authentication Defeated [221]
• 2010-09-28: Zitmo Follow Up: From Spyware to Malware [360]
• 2010-10-01: Risky Business #170 -- The week of Zeus! [416]
• 2010-10-28: Some thoughts and facts about ZeuS MitMo [270]
• 2011-02-21: ZeuS straszy polskie banki (ING i mBank) [220]
• 2011-02-25: ZeuS in the Mobile is back [226]
• 2011-10-06: ZeuS-in-the-Mobile – Facts and Theories [207]
• 2012-08-07: New ZitMo for Android and Blackberry [225]
• 2012-11-28: A Case Study of Eurograbber: How 36 Million Euros was Stolen via Malware [208]
• 2014-06-06: McAfee Labs Threat Advisory: PWS ZBot [390]

Version	Count	ITW	IOCs	Reference Sample	Notes
2.0.8.0	1	2022-07-08	Samples	f831d088c3a64b06843d970337f1c8877c9c1988d56720a7dee9d67efeaf78f0 (VT MB)
2.0.8.11	27	2010-09-27	Samples	be8703a1df11cbc97e900ed1d88fe5b37501083595912f9b6844e8dcf4299d9d (VT MB)
2.0.8.13	2	2013-03-11	Samples	9cd8955eea9a9bdadff4a4b0a05d95d3a88aadfdcb003560a524f2b0f58fdce8 (VT MB)

---

curator@zeusmuseum.com / @tildedennis