zeusmuseum. - Citadel

Citadel

23335 samples
Based on the Citadel version 1.3.5.1 reference sample deep dive:
- 792 functions
- 311 encrypted strings
- The C2s are stored in an encrypted BaseConfig using XOR
- DynamicConfig requests use a custom RC4 key scheduling algorithm (KSA)
- DynamicConfig responses use AES with an extra XOR encryption
- 40 commands
- 2 modules: cit_ffcookie.module and cit_video.module

References (58)

2009-02-09: Introducing: abuse.ch ZeuS Tracker BETA [108]
2012-01-23: ‘Citadel’ Trojan Touts Trouble-Ticket System [198]
2012-01-28: Citadel Zeus bot [316]
2012-02-08: Citadel - An Open-Source Malware Project [197]
2012-02-09: Collaboration Fuels Rapid Growth of Citadel Trojan [354]
2012-02-13: Darkode Repository: Citadel 1.1 - FF_IE_Chrome Grabber + Video Recording & C [487]
2012-03-12: Citadel : le fichier de configuration [374]
2012-03-19: Citadel 1.3 [317]
2012-04-03: Update to Citadel : v1.3.3.5 [321]
2012-06-11: Update to Citadel : v.1.3.4.5 [319]
2012-06-28: Cambios en Citadel: AntiVM y cifrado [38]
2012-07-02: HURRY! CITADEL IS GOING OFF THE OPEN MARKET! [48]
2012-07-29: Inside Citadel 1.3.4.5 C&C & Builder - Botnet Control Panel [322]
2012-08-11: Citadel [324]
2012-09-14: Citadel Trojan Malware Analysis [375]
2012-10-04: Update to Citadel : 1.3.5.1 Rain Edition. [320]
2012-10-17: Citadel 1.3.5.1 Rain Edition [323]
2012-10-18: Citadel V1.3.5.1: Enter the Fort’s Dungeons [49]
2012-11-05: Citadel: a cyber-criminal’s ultimate weapon? [253]
2012-11-28: Updates to the Citadel Trojan [60]
2012-12-05: The Citadel crimeware kit – under the microscope [243]
2012-12-07: Troyan Citadel BackConnect VNC Server Manager [325]
2012-12-11: Citadel’s Steward Banned from Underground Venues [47]
2012-12-14: Malware Analysis: Citadel [327]
2013-01-11: Demystifying Pobelka [376]
2013-02-20: Inside the World of the Citadel Trojan [112]
2013-04-16: Takedown of the plitfi Citadel botnet [326]
2013-06-05: Citadel botnet Legal Notice [449]
2013-06-07: Collateral Damage: Microsoft Hits Security Researchers along with Citadel [352]
2013-06-14: Citadel lawsuit and explanation of John Doe 25 [465]
2013-06-28: Citadel hasn't gone [313]
2013-09-01: Zeus-R-uS [315]
2014-01-02: Thomas Kennedy McCormick FBI Interview [381]
2014-02-12: Email Attack on Vendor Set Up Breach at Target [382]
2014-02-15: Citadel "involution" [314]
2014-02-18: Fight Against Citadel in Japan [254]
2014-03-14: Top Banking Botnets of 2013 [237]
2014-04-27: Crimeware based Targeted Attacks: Citadel case, Part III [202]
2014-08-18: The Zeus botnet and the making of a cyber crime market [414]
2014-12-05: ZeuS meets VM [329]
2015-09-02: FBI og Kripos pågrep russer i Fredrikstad [383]
2015-09-06: Citadel 1.1 - FF/IE/Chrome Grabber/Video Recording, AntiTracker Protection & CRM [384]
2015-09-07: Arrests Tied to Citadel, Dridex Malware [336]
2015-09-29: Russian Developer of the Notorious “Citadel” Malware Sentenced to Prison [422]
2016-02-19: Banking Trojan “Citadel” Returns [252]
2016-02-19: Citadel 0.0.1.1 (Atmos) [251]
2016-04-11: Security Alert: Citadel Trojan Resurfaces as Atmos, builds on ZeuS Legacy [211]
2016-06-07: MMD-0054-2016 - ATMOS botnet facts you should know [330]
2017-03-14: Russian Hacker “Kolypto” Extradited from Norway [426]
2017-04-18: Configuring Zeus: A case study of online crime target selection and knowledge transmission [358]
2017-07-19: Russian Citizen who Helped Develop the "Citadel" Malware Toolkit is Sentenced [432]
2017-07-25: How a Citadel Trojan Developer Got Busted [351]
2018-06-02: 0.0.1.1 (Atmos) Panel and Builder [113]
2019-12-18: Citadel (Zeus clone) [31]
2019-12-18: win.citadel [17]
2021-05-07: Four Individuals Plead Guilty to RICO Conspiracy Involving “Bulletproof Hosting” for Cybercriminals [425]
2021-10-20: Two Individuals Sentenced for Providing “Bulletproof Hosting” for Cybercriminals [433]
2022-12-11: The non-mythological story of Zeus #botnet [450]

Version	Count	ITW	IOCs	Reference Sample	Notes
0.0.1.0	195	2015-01-12	Samples	27b86c92d6a04f4074462098e1ea9c0142816b66667effecb36ccde317458166 (VT MB)
0.0.1.1	1510	2015-05-31	Samples Webinjects	76494ca680d605eca75201ecf6c87bf1c6070c640e95bf3acfd633ac529a8487 (VT MB)	aka Atmos
1.1.0.0	47	2013-08-18	Samples	fcce249643f7fe240695fdbc393b54a543fa4a49942b56ad8aad6f219c4f896d (VT MB)
1.1.4.0	15	2012-01-17	Samples	4a6a8f6c1322b7422ba3d72fc223860d0be9073cde27bcfe5365f8135f1ae441 (VT MB)
1.1.5.1	6	2012-01-30	Samples	ba17f2ed642b9376a974263ac207dc55385c8d09119c89c5b1afb3b20215705a (VT MB)
1.2.0.0	5	2012-02-02	Samples	989d34e7e12df031098bc9898451e765b2a79c9af7416ea9906f81e95755cc20 (VT MB)
1.2.0.0b	60	2013-10-10	Samples	371b9214f60a70c81ec1756d284e8028ff7603498341ecb7fa5cc09f3b10043e (VT MB)
1.2.4.0	18	2012-02-04	Samples	54d67f153de6ba73daf1b037057cf5c0550cfb6c0aee53c5d5119a9a3647b300 (VT MB)
1.3.0.0	13	2012-02-27	Samples	0b9f7b9a33b0b9dca2c47d7a5df89087638ebab1468070c3416ff13fbb643dc5 (VT MB)
1.3.0.0b	4	2013-12-18	Samples	dd4a1d6b9752677f41861a343945230cbfced64ed31d24977557d7307897545d (VT MB)
1.3.1.0	13	2012-02-24	Samples	4c850cfff31192c9f8439e0b9e4127d0b419c9909d2c85e7e99a5bb0115db3c9 (VT MB)
1.3.2.0	42	2012-03-09	Samples	118185aed4dd97bbf3fe28bebb075a67ca7dbf75dee24efa999e170ee13d0396 (VT MB)
1.3.3.0	1	2014-08-15	Samples	747d453eb50403d9aee95c2ae18fbb735a7a3ac8dc68c6842e94c7d64e4fcc11 (VT MB)
1.3.3.1	6	2012-03-23	Samples	cf813a86d30ddd0c2ca59f73334fffd241bfd31eddfe30dc2e73d5b29ae752d1 (VT MB)
1.3.3.2	2	2012-03-30	Samples	d3dfd9d66ff6e1651144877a7695303dec346e27cb2b78c851b10faf8957ae62 (VT MB)
1.3.3.3	75	2012-03-21	Samples	deb51e50b4628567f8690316317083aa337b10d9a23cbbf5d8a21b6d6e8e194f (VT MB)
1.3.3.4	112	2012-03-27	Samples	3675db37a5c08fdd062e3b5aae428ca2346375c05ca2ab252ef8403d2ce655e9 (VT MB)
1.3.3.5	306	2012-04-04	Samples	d29b6d3a43795f840214bdc2e46255566c9840e8aa16cce8704b8eaf34cfba83 (VT MB)
1.3.4.0	1931	2012-04-26	Samples	f1c63b15b0244a6f956cdbfc811d1990be99f8e5fa4027403b4f1aaf1de312a2 (VT MB)
1.3.4.5	2344	2012-06-20	Samples Webinjects	ff92eb5433354ad51ba6c586ed91e8b69f32271b0d523352c87f8ae4d075151b (VT MB)	aka Extreme Edition
1.3.5.0	7	2012-09-14	Samples	79e49f532968d8b8ffa58e61e72135d2faf6e7384733f1e6386c9169d746138a (VT MB)
1.3.5.1	16135	2012-10-08	Samples Samples Samples Webinjects	aa84cc4fd2150d0dd0986943e8567dca381c47c69b29673e8ba120d922fcced3 (VT MB)	aka Rain Edition
3.0.0.0	1	2014-08-14	Samples	9fd9a04134b3d43f451c21c5df09d603132aefe6149b0842eb810710276e31ad (VT MB)
3.1.0.0	487	2013-05-06	Samples	1ec347934db2ded3a012479882732bfb3cdc85b0d4b2911e3402c1fa693a2235 (VT MB)

curator@zeusmuseum.com / @tildedennis