zeusmuseum.

KINS (Kasper internet non-security)

10980 samples
Based on the KINS version 2.0.0.0 reference sample deep dive:
- 730 functions
- 516 encrypted strings
- The BaseConfig is decrypted using a virtual machine
- The C2s are stored RC4 encrypted in the decrypted BaseConfig. There is also a plaintext fake C2
- The encrypted DynamicConfig is stored as base64 inside a text comment of a JPG image
- The DynamicConfig is encrypted using RC6 and "visual decrypt"
- 29 commands
KINS vs. PowerZeus is confusing. More research is required, but here are some notes:
- Some references at the time treated them as aliases of each other
- The leaked source code is named "KINS", but only in archive names (e.g. KINS.7z) and GitHub metadata (e.g. repository names and READMEs)
- The leaked source code doesn't contain the "Kasper" logo
- The leaked source code does contain KINS' BaseConfig virtual machine implementation (in configcrypt.cpp and configcrypt.h), but it isn't used or referenced outside those files
- The leaked source code uses DllConfig::getCurrent (which is very DynamicConfig-like, including webinjects) instead of the more traditional Core::getBaseConfig
- The leaked source code is version 1.0.2.0
- PowerZeus samples are version 1.0.2.0
- PowerZeus samples don't use KINS' BaseConfig virtual machine implementation, but DllConfig::getCurrent

References (14)

2009-02-09: Introducing: abuse.ch ZeuS Tracker BETA [108]
2013-07-23: KINS Banking Trojan a Successor to Citadel? [418]
2013-07-23: New Trojan #INTH3WILD: Is Cybercrime Ready to Crown a New “KINS”? [46]
2013-07-25: Analysis of the KINS malware [37]
2013-09-01: Zeus-R-uS [315]
2014-02-17: Hiding in plain sight: a story about a sneaky banking Trojan [258]
2014-05-22: Meet the Zberp Trojan [248]
2014-07-07: Zeus PIF - The evolving strain looking to defeat your security software [201]
2014-08-18: The Zeus botnet and the making of a cyber crime market [414]
2014-12-05: ZeuS meets VM [329]
2015-07-05: MMD-0036-2015 - KINS (or ZeusVM) v2.0.0.0 tookit (builder & panel source code) leaked. [328]
2019-12-18: ZeusVM (Zeus clone) [34]
2019-12-18: win.vmzeus [23]
2022-04-22: thecrimewarearchive/zeusvm-v2.0.0.0 [408]

Version	Count	ITW	IOCs	Reference Sample
1.0.0.1	15	2013-04-17	Samples	74c975e466910e51d9a87fcffdc408e88df2aef3d8b0a9011faf70015966f013 (VT MB)
1.0.0.2	947	2013-11-03	Samples	75352a45b67b3a7f91e237cc5dc2de79f52e0e13b81fe10e289199477f2d46c9 (VT MB)
1.0.0.4	2	2014-02-27	Samples	ba516dbe1b2e00f3d4e20a5b8b90ef9d7e0850ec82350f84aa6fe42583d5bd68 (VT MB)
1.0.0.5	489	2014-02-16	Samples Webinjects	5b892ce9a266715a38a7d46284582d2821f630d24a38db350795eab5da951c42 (VT MB)
1.0.1.0	286	2014-04-30	Samples	2175bd94c8f6b7a75f4058bb9b981c2dee39a34a51afe018ebecfbffa490656c (VT MB)
2.0.0.0	8269	2014-06-04	Samples Samples Webinjects	d438e335c09a20fead74cc90cff02568ebaf0d226046b1d4e7fdf2656e87d960 (VT MB)
2.0.9.9	13	2011-09-15	Samples	4dfd38dbb39f3ed69c713f601bc52b663a5cd08d37a2ececcbf8d54d8d179f05 (VT MB)
2.0.9.11	2	2011-08-21	Samples	88e5a0c6078b056bfada680002ba93dbbb3d567acb212bccab8418f6e4adc6ea (VT MB)
2.0.9.13	71	2011-10-23	Samples	8bab13995983e8072027da514a3f8aaea38a4c26400fb63e1f4b855ff9a82971 (VT MB)
2.0.9.14	25	2011-11-25	Samples	4871a6de5ad98ba04f4e3180dcb21ed7d649f5ee74c086aac859005f09952520 (VT MB)
2.0.9.15	197	2012-05-07	Samples Webinjects	b19f6698a91cc818c14952c74e99db302c229d1f868d144f9344f83d9ecf6825 (VT MB)
2.0.11.0	73	2015-05-16	Samples	0c780ce6cb4281a12cf329e18bdf36b987e34dd15379a4c2f6f8e03ba56e13be (VT MB)
2.0.12.0	258	2015-05-26	Samples Webinjects	7308b321667d579fbab79329977c8396721f9211be62b99b3abb3ae8e49dbcb4 (VT MB)
2.0.14.0	318	2015-07-07	Samples Webinjects	f696348658a9b89041b6bf9bdc9a3ae8f3799c5beee76e42dc81f096307c7847 (VT MB)
3.1.0.0	5	2015-08-09	Samples	798c6be4ea73c2d7c936f0d86b804b636188f249fd813f62722565923c158e0b (VT MB)
3.2.0.0	9	2015-08-26	Samples	02b0990c02754ffbf410cd42a50136215946b4e20a943bbd24ddb5c2b4f62be6 (VT MB)
3.3.0.0	1	2015-11-12	Samples	e8a83b5d764c72a3c9c7ec2c5711ca045c3356a4c4d8de999efcacf291bd8b2b (VT MB)

curator@zeusmuseum.com / @tildedennis