Murofet (LICAT, Zeus 2.1)

• 433 samples
• Based on the Murofet version 0.0.0.8 reference sample deep dive:
  • 620 functions
  • 264 encrypted strings
  • A C2 is stored in an encrypted BaseConfig using XOR
  • There is a date-based domain generation algorithm (DGA)
  • Data from the C2 is verified using a signature and embedded RSA public key
  • The DynamicConfig is encrypted using RC4 and "visual decrypt"
  • 25 commands
  • Its webinjects use Perl Compatible Regular Expressions (PCRE)
  • Checks socket data for credit card track data

References (23)

• 2010-10-09: Win32.Murofet: what day is today? [361]
• 2010-10-14: Murofet: Domain Generation ala Conficker [214]
• 2010-10-17: The Plot Thickens for ZeuS-LICAT [53]
• 2010-10-27: File-Patching ZBOT VariantsZeuS 2.0 Levels Up [74]
• 2010-11-08: Looking Back at Murofet, a ZeuSbot Variant’s Active History [213]
• 2010-12-02: Updated ZeuS-LICAT Variant Spotted [277]
• 2011-05-12: What is Zeus? [116]
• 2011-09-01: The New Frontier For Zeus & SpyEye [460]
• 2011-09-29: Organized Cybercrime: Nefarious Sophistication Featuring Zeus V2.1.0.10 [205]
• 2013-09-01: Zeus-R-uS [315]
• 2014-06-02: FBI disrupts GameOver ZeuS and CryptoLocker Botnet [333]
• 2015-12-29: GameOver Zeus: Badguys And Backends [421]
• 2016-12-29: FACT SHEET: Actions in Response to Russian Malicious Cyber Activity and Harassment [423]
• 2017-05-15: Evolution of the GOLD EVERGREEN Threat Group [203]
• 2019-07-01: Exposing Evgeniy Mikhaylovich Bogachev and the "Jabber ZeuS" Gang - An OSINT Analysis [172]
• 2019-12-18: win.murofet [24]
• 2021-01-04: Stopping Serial Killer: Catching the Next Strike [266]
• 2021-06-29: Virus:Win32/Murofet.A [297]
• 2022-11-15: Top Zeus Botnet Suspect “Tank” Arrested in Geneva [445]
• 2023-12-08: Jabber Zeus [492]
• 2024-02-15: "Tank" Plea Agreement [505]
• 2024-03-01: "Tank" Change of Plea [506]
• 2024-07-11: Notorious Hacker Kingpin ‘Tank’ Is Finally Going to Prison [504]

Version	Count	ITW	IOCs	Reference Sample	Notes
0.0.0.2	1	2010-12-15	Samples	cd8866eb2cbece6ba962759199a5b456e4e00334d8c46a91160cb4e20f988438 (VT MB)
0.0.0.3	6	2010-12-13	Samples	9b18a3d6d3381cce0f58f433e0bc7bddcf12b7ffde0094ce8842239ad72da570 (VT MB)
0.0.0.4	14	2010-12-22	Samples	52576fe06db6c4cf5e307a8c86fc53d5f4ecfd5879fb7d7835c99843f2a069c6 (VT MB)
0.0.0.5	14	2011-01-22	Samples	8c9087b9e6af76699ab0777535b2e99c4a345f6d4714953604367adfc4a8f7c1 (VT MB)
0.0.0.6	76	2011-02-12	Samples	ea5f48d67be02c10be233f036a23126577e2f394335a78e3d44c8bcb3e754caa (VT MB)
0.0.0.7	98	2011-05-10	Samples	08a989233f339732da10dcc9ab1931f1ee5da84c7ae482ff7b2abdbc85d44b49 (VT MB)
0.0.0.8	186	2011-07-07	Samples	1a30a352a65cf6ad2b9b8266617709672c777e58edaa625946d77aca427cd352 (VT MB)
2.1.0.7	6	2010-10-13	Samples	050458750f20063832b0c1b62e83e4def62d1e29b5399ac871683438e5c5c584 (VT MB)
2.1.0.8	13	2010-10-31	Samples	bf46e9f5591549bce5526ff3046cd79e19951eefd115be086ce52ef40be592fa (VT MB)
2.1.0.9	19	2010-11-26	Samples	673f32e6f3223ae252ef6a93ded39272d62e495b366f5744afeff5569a280ff9 (VT MB)

---

curator@zeusmuseum.com / @tildedennis