Prg (wsnpoem, ntos)

• 1964 samples
• Early Zeus that doesn't use SBCID_BOT_VERSION, BASECONFIG, BinStorage, and other common Zeus things
• Based on the Prg version 31 reference sample deep dive:
  • 124 functions
  • No encrypted strings
  • The C2 is stored encrypted in the PE header using an arithmetic based algorithm
  • The DynamicConfig is encrypted using the same algorithm as the C2
  • 1 command
  • Windows APIs are resolved at runtime

Actors (1)

• Name: Evgeniy Mikhailovich Bogachev
  • Aliases: lucky12345@jabber.org, lucky12345@jabber.cz, Lastik, Monster, bashorg@talking.cc, MonsterTrack, alexgarbarchuck@yahoo.com, ICQ 427297771

References (22)

• 2006-11-13: [Prg] Malware Case Study [275]
• 2007-06-25: PRG Trojan [287]
• 2007-07-16: Ransomware... Holding Corporate America Ransom! [467]
• 2007-07-17: Trojan.Gpcoder.E [392]
• 2007-07-17: ntos.pdf [469]
• 2007-07-19: Connecting the dots on the ransomware case [468]
• 2007-07-23: The Evolution of GPCode/Glamour RansomWare [499]
• 2007-08-09: Hackers steal U.S. government, corporate data from PCs [466]
• 2007-08-16: Prg Trojan-Injected Ads on Job Sites – 46,000 Victims Infected Thus Far [406]
• 2007-08-17: A Monster Trojan [500]
• 2007-08-17: Would You Like A Job With That Virus? [497]
• 2007-08-21: Would you apply for this job? [501]
• 2007-11-30: Malicious code evolution: July – September 2007 [391]
• 2007-12-12: Hackers Use Stealthy, New Prg Banking Trojan to Attack Commercial Banking Clients in Four Countries [286]
• 2009-09-19: HAR 2009: The ZeuS evolution 2/6 [397]
• 2009-09-19: HAR 2009: The ZeuS evolution 3/6 [398]
• 2009-09-19: HAR 2009: The ZeuS evolution 4/6 [399]
• 2009-09-19: HAR 2009: The ZeuS evolution 5/6 [403]
• 2010-02-23: Rise of the Point-and-Click Botnet: A kit lets beginners craft sophisticated attacks. [409]
• 2010-07-28: BigBoss Check Counterfeiting Ring [394]
• 2016-12-29: FACT SHEET: Actions in Response to Russian Malicious Cyber Activity and Harassment [423]
• 2022-02-22: EP 111: ZeuS [396]

Version	Count	ITW	IOCs	Reference Sample	Notes
1	14	2012-06-08	Samples	0798aa9b84cfc0805ba08d1c190d1f94edb3f2d1988eb6d6307b1af950e3d75b (VT MB)
1.0.2.11	84	2023-04-14	Samples	6855843f9d23ab29ea40bd14abee4b8d8b28245c44d3154e0bc0c66ae6e3002a (VT MB)
1.0.2.14	4	2023-06-29	Samples	3fe5bc0c1fc6b9ecef57829e18f8c8f0bcb9173a9ad8e167138389d4eced835c (VT MB)
1.0.2.15	7	2023-06-08	Samples	42705a81a3213127349c8a22188e0eddcce254f8675f5c17bc8e3513ab7c8ce8 (VT MB)
1.0.3.5	5	2023-07-30	Samples	78e23c0e50dc640d22b48e9a089c887ab3324b33815a5196bc1781120914cfe6 (VT MB)
1.0.3.7	53	2022-11-28	Samples	d04f272f5549f5dba21e281a761c3c702cbc3993d0236cc1f5708a7077a93efc (VT MB)
1.0.3.8	3	2023-07-30	Samples	510e6c54043714ed28397bb5998cb93bfaf2dee037eb93720475c5d37c04e768 (VT MB)
1.0.4.0	12	2023-07-29	Samples	b6c2b60ae59ecefbfb43747a05d48a58fbd75dee7b094f9e61c694a6f7c864db (VT MB)
1.0.4.1	14	2023-06-12	Samples	06af507fabf065b179f1f682b662ef333ece031d9fc081fcd70c2a9103571a26 (VT MB)
1.0.4.8	20	2007-10-10	Samples	3677070874e81e997c23f5a5a6279d60ef0e73617f9a2fdf4622c06f1958ee02 (VT MB)
1.0.4.9	10	2023-08-17	Samples	0fc714c5680d2c16e591e47a6cefe25a55c4dca19385cdda36f38e93208d29c5 (VT MB)
1.0.4.10	13	2023-07-15	Samples	12fec07afaabbcbc0d5146a963bfc55d04ee7f27b52328e467cc8c47dc798eee (VT MB)
1.0.4.12	1	2023-04-27	Samples	c72b40dc09749cc380491ebffca210c19004ebebc003e80b94852b23d0267a9b (VT MB)
1.0.4.15	18	2023-07-31	Samples	f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4 (VT MB)
1.0.4.16	16	2023-04-27	Samples	b96c33bae429f82baaa4f029296b97e43675101131b369a29dd486f6f9cd1fef (VT MB)
1.0.4.18	19	2023-04-14	Samples	922b2a0fe4bdae36601636a033c1861fd49a3e9c62b264b51b726051d147f10b (VT MB)
1.0.4.20	12	2023-05-13	Samples	1bb4c2f5c32c8591dc7f09569721553ef6d2b1c38531ca537b22520dfb18ac9f (VT MB)
1.0.4.26	45	2023-05-19	Samples	2e6a439fc0a63ae1ac5a42ef25884c1568bec9ed856249ca7d387a8a4d281eb8 (VT MB)
1.0.5.4	14	2023-07-31	Samples	551efbb7852edf2043218058fb78e9c399e33236b73106bde315d361dd0566da (VT MB)
1.0.5.5	3	2023-07-29	Samples	8e6e43df08951916adca26672320ee3100c0605b9355eb74bf529c66546ffbb5 (VT MB)
1.0.5.8	37	2023-05-20	Samples	ec9257a7e5347a85b1bc6b9ec2df8e2bf4a769d17db4988dc8f25a54fe766ba8 (VT MB)
1.0.5.9	15	2023-05-01	Samples	4879a4c32066241aa79a455ed748d9a16f6f3e6ed3354328da0d212b44c75ebd (VT MB)
1.0.5.10	53	2022-08-10	Samples	5013e1d8951c06ab4fb3d364ce11d319922f26a616be9e2ade3ecb82ecfad817 (VT MB)
1.0.6.0	27	2023-06-12	Samples	a40bff9dcaecf139c90bee8a02955012c6a12c596e353e33fc9c9a1875449131 (VT MB)
1.0.6.2	28	2023-06-22	Samples	aaf93f6187f18b40300a9135bd49a9b8dafab53c2ef5ccdae122e8ccb552b9b4 (VT MB)
1.0.6.7	12	2023-04-30	Samples	860b10d5f6ed534bff3a8097a8fe08a5914e6b20631d9ee11cc05eb606324826 (VT MB)
1.0.6.8	28	2023-05-03	Samples	0c9be3ce8238637a3eaf5dee061f00865429f66f3ef44c07c4664bcd691d0955 (VT MB)
1.0.6.9	1	2024-02-05	Samples	1207199c662ef02c36e37beee575f6dbd6dc46013b662ffb3b26a749764b6f15 (VT MB)
1.0.6.14	1	2024-02-05	Samples	5048ad9700511dde2600bc9374c21e821f4714251c5e8ce4d530858024223f1d (VT MB)
1.0.6.16	3	2023-07-15	Samples	98c51edd1b00b795c3cd639ff43fe5acaed66f779c52aeecb1172079be3738d1 (VT MB)
1.0.6.19	1	2022-11-18	Samples	d53bda0838a3db470a20a273d1effee7ef42bbc0a337fbb65eddfe079a5d0206 (VT MB)
1.0.6.21	49	2013-06-29	Samples	d81322811538084bf9a91914f16e9aff3ff7b2aaa16969225dfccf2c0aab6bd1 (VT MB)
1.0.6.24	44	2023-06-08	Samples	9ffa421a091d5ef693ac93ab09b2aac37d59888d07f8e67fda4327d521f84d5b (VT MB)
1.0.6.25	14	2023-06-18	Samples	231174108b0b282e7c9237de612203cd5aaee96b0ced55a17634aa6f9ef85780 (VT MB)
1.0.6.27	72	2019-11-30	Samples	b91e55cb98ab74532100bd9f70384d41f6b878317e86f0b0325aa0b928dc95c5 (VT MB)
1.0.6.29	1	2022-10-03	Samples	335b483be1df507c97be0d3d55105898dd86fb067b673f64cfe5817e1538c79c (VT MB)
1.0.7.0	94	2023-04-23	Samples	7e30376b1f2ce098baaa3aca6919fb3e945e94a320afe70ede333e4319e4f695 (VT MB)
1.0.7.5	7	2023-06-11	Samples	7508eff860b58b5ae2bd47c89cc8cacfbeba08b5fe3084d7b6dd44f486cea2d7 (VT MB)
2	2	2022-03-28	Samples	37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce (VT MB)
5	60	2014-02-19	Samples	88c9bd2ec09ddec7b103660c9dd8b3afc2c72ecc469bd327106c598e1f58a520 (VT MB)
10	6	2011-03-04	Samples	fa3d1e0d938aea74098020ca657c0e138a88a25c267a90730cb603780621fb14 (VT MB)	Ransomware functionality
11	768	2010-11-01	Samples	aa0762d7122483c149976660ef7fd4ad159e037614e5b3ba7fdf6a26b90b80a7 (VT MB)
12	54	2018-08-03	Samples	c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2 (VT MB)
13	19	2009-05-09	Samples	fa4b250a594d746f135c06cd5a8ae9b544fb143c86e77f14add777c54f59e21b (VT MB)
15	3	2015-04-07	Samples	e56d21df2d2afd91a3dcc7fce9e39a2f9588957d40c04ec919e723bb9b067124 (VT MB)
19	59	2006-10-07	Samples	f964fe787eaafa4622c0ed9a8bdbf6a223d483ddce92109f75643f048a6a661b (VT MB)
20	11	2022-04-13	Samples	1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea (VT MB)
22	15	2012-10-10	Samples	b5eb858ed1498c31460c40a12eb6e989b2cd01c17cac48c5337eca8230bbbcf1 (VT MB)
26	1	2019-07-23	Samples	cb484f57d79564c8f7b685c7c7c578c4eaf5ca29e8616fd80f633fe7f9c75b58 (VT MB)
28	6	2016-05-12	Samples	d91dd9570b91f6846291a727b5ac816e627b11cd9772a40b8dd66ba06503a585 (VT MB)
29	8	2012-05-10	Samples	d9b129c1eb6c4e4aba085a039b13d7e895938c04e2ca8e6d4afe3f8317faa96d (VT MB)
31	21	2012-09-05	Samples	d903fe1ba67138993ca3f1f4d86321610b47a068ad9bbc6245ab1f8e79778034 (VT MB)
32	8	2012-12-25	Samples	4bdee6083fc6a32ed77487d76cec724de78ced68f1555dfe97444f269f58eb94 (VT MB)
35	6	2013-07-24	Samples	c2a939d4d9c6cff6e3aa069cb50ec292313fa38f83d2a5d99ae97b0a6ff01356 (VT MB)
37	8	2011-06-16	Samples	ab55291b0ee6a9f6c84426d1cb2235e38f3ed9764cb36e92b259f056ee8bce8f (VT MB)
40	15	2006-11-07	Samples	a3398f91815a1a025fd19ce86b9fb88160047b5d78973b352d266ef1bd971e6d (VT MB)
43	11	2013-04-04	Samples	269b5b31bacfb2afa825f97e01f76617e71d11cb6391256142dc11eac0e1459d (VT MB)
48	25	2007-02-05	Samples	e80bff855228e7b8e810ac5d10e25f61861b946cb90b1d714cd56dbe599c8015 (VT MB)
768	2	2019-03-16	Samples	cc30bcaa3a0f8c165a4ac26b08e8c061faf042693c9529a53192a529bc4cd9f8 (VT MB)	More similar to earlier versions than later ones.
770	2	2019-06-04	Samples	b284b6cc53f3fd14bbe580e7f2313d2647c53158069c7249e86edb4da749e408 (VT MB)	More similar to earlier versions than later ones.

---

curator@zeusmuseum.com / @tildedennis