Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in processes and use them to, for example, steal data. But, if the trojan is itself an exe file, how does it do such things?

Does it carry a DLL to do all the hooking, or does it inject shellcode into the process it wants to modify, or something else?

  • I'll note that a trojan doesn't need to "hook in" to a process, it's easy for a process on your machine to log keyboard input which can be used to steal data. – sethmlarson Jan 26 '16 at 17:56

I don't know about Zeus in particular, but generally speaking, it's easy to do this using debug APIs like VirtualProtectEx and WriteProcessMemory. Open a HANDLE to the target process, add some executable memory (with VirtualAllocEx), put some malicious code in there, re-map the virtual address of the executable code of the library that holds your target API as RWX, overwrite the first few bytes of the function you want to hook with a jump instruction that goes to your injected malicious code, and you control everything that function does.

There are plenty of other ways to achieve similar results; the use of the debug APIs and overwriting the entry points of real functions is just one example I've seen in the real world. The malicious program can do this each time the debuggee (victim) loads a new library, including all the ones loaded at process initialization, before the victim's main() even executes.

DLL injection (which can do the hooking from within the process, no need to do anything inter-process at all) and compatibility shims (like are used for running programs in "compatibility mode" for older OS versions, and replace system APIs with different code) are two other handy options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.