Prg (wsnpoem)

• 1124 samples
• Early Zeus that doesn't use SBCID_BOT_VERSION, BASECONFIG, BinStorage, and other common Zeus things
• Based on the Prg version 31 reference sample deep dive:
  • 124 functions
  • No encrypted strings
  • The C2 is stored encrypted in the PE header using an arithmetic based algorithm
  • The DynamicConfig is encrypted using the same algorithm as the C2
  • 1 command
  • Windows APIs are resolved at runtime

Actors (1)

• Name: Evgeniy Mikhailovich Bogachev
  • Aliases: lucky12345@jabber.org, lucky12345@jabber.cz, Lastik, Monster, bashorg@talking.cc, MonsterTrack, alexgarbarchuck@yahoo.com, ICQ 427297771

References (18)

• 2006-11-13: [Prg] Malware Case Study [275]
• 2007-06-25: PRG Trojan [287]
• 2007-07-16: Ransomware... Holding Corporate America Ransom! [467]
• 2007-07-17: Hackers steal U.S. government, corporate data from PCs [466]
• 2007-07-17: Trojan.Gpcoder.E [392]
• 2007-07-17: ntos.pdf [469]
• 2007-07-19: Connecting the dots on the ransomware case [468]
• 2007-08-16: Prg Trojan-Injected Ads on Job Sites – 46,000 Victims Infected Thus Far [406]
• 2007-11-30: Malicious code evolution: July – September 2007 [391]
• 2007-12-12: Hackers Use Stealthy, New Prg Banking Trojan to Attack Commercial Banking Clients in Four Countries [286]
• 2009-09-19: HAR 2009: The ZeuS evolution 2/6 [397]
• 2009-09-19: HAR 2009: The ZeuS evolution 3/6 [398]
• 2009-09-19: HAR 2009: The ZeuS evolution 4/6 [399]
• 2009-09-19: HAR 2009: The ZeuS evolution 5/6 [403]
• 2010-02-23: Rise of the Point-and-Click Botnet: A kit lets beginners craft sophisticated attacks. [409]
• 2010-07-28: BigBoss Check Counterfeiting Ring [394]
• 2016-12-29: FACT SHEET: Actions in Response to Russian Malicious Cyber Activity and Harassment [423]
• 2022-02-22: EP 111: ZeuS [396]

Version	Count	ITW	IOCs	Reference Sample	Notes
1	14	2012-06-08	Samples	0798aa9b84cfc0805ba08d1c190d1f94edb3f2d1988eb6d6307b1af950e3d75b (VT MB)
2	2	2022-03-28	Samples	37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce (VT MB)
5	60	2014-02-19	Samples	88c9bd2ec09ddec7b103660c9dd8b3afc2c72ecc469bd327106c598e1f58a520 (VT MB)
10	6	2011-03-04	Samples	fa3d1e0d938aea74098020ca657c0e138a88a25c267a90730cb603780621fb14 (VT MB)	Ransomware functionality
11	768	2010-11-01	Samples	aa0762d7122483c149976660ef7fd4ad159e037614e5b3ba7fdf6a26b90b80a7 (VT MB)
12	54	2018-08-03	Samples	c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2 (VT MB)
13	19	2009-05-09	Samples	fa4b250a594d746f135c06cd5a8ae9b544fb143c86e77f14add777c54f59e21b (VT MB)
15	3	2015-04-07	Samples	e56d21df2d2afd91a3dcc7fce9e39a2f9588957d40c04ec919e723bb9b067124 (VT MB)
19	59	2006-10-07	Samples	f964fe787eaafa4622c0ed9a8bdbf6a223d483ddce92109f75643f048a6a661b (VT MB)
20	11	2022-04-13	Samples	1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea (VT MB)
22	15	2012-10-10	Samples	b5eb858ed1498c31460c40a12eb6e989b2cd01c17cac48c5337eca8230bbbcf1 (VT MB)
26	1	2019-07-23	Samples	cb484f57d79564c8f7b685c7c7c578c4eaf5ca29e8616fd80f633fe7f9c75b58 (VT MB)
28	6	2016-05-12	Samples	d91dd9570b91f6846291a727b5ac816e627b11cd9772a40b8dd66ba06503a585 (VT MB)
29	8	2012-05-10	Samples	d9b129c1eb6c4e4aba085a039b13d7e895938c04e2ca8e6d4afe3f8317faa96d (VT MB)
31	21	2012-09-05	Samples	d903fe1ba67138993ca3f1f4d86321610b47a068ad9bbc6245ab1f8e79778034 (VT MB)
32	8	2012-12-25	Samples	4bdee6083fc6a32ed77487d76cec724de78ced68f1555dfe97444f269f58eb94 (VT MB)
35	6	2013-07-24	Samples	c2a939d4d9c6cff6e3aa069cb50ec292313fa38f83d2a5d99ae97b0a6ff01356 (VT MB)
37	8	2011-06-16	Samples	ab55291b0ee6a9f6c84426d1cb2235e38f3ed9764cb36e92b259f056ee8bce8f (VT MB)
40	15	2006-11-07	Samples	a3398f91815a1a025fd19ce86b9fb88160047b5d78973b352d266ef1bd971e6d (VT MB)
43	11	2013-04-04	Samples	269b5b31bacfb2afa825f97e01f76617e71d11cb6391256142dc11eac0e1459d (VT MB)
48	25	2007-02-05	Samples	e80bff855228e7b8e810ac5d10e25f61861b946cb90b1d714cd56dbe599c8015 (VT MB)
768	2	2019-03-16	Samples	cc30bcaa3a0f8c165a4ac26b08e8c061faf042693c9529a53192a529bc4cd9f8 (VT MB)	More similar to earlier versions than later ones.
770	2	2019-06-04	Samples	b284b6cc53f3fd14bbe580e7f2313d2647c53158069c7249e86edb4da749e408 (VT MB)	More similar to earlier versions than later ones.

---

curator@zeusmuseum.com / @tildedennis