zeusmuseum. - Zeus 2

Zeus 2 (Zbot)

15119 samples
Based on the Zeus 2 version 2.0.8.9 reference sample deep dive:
- 565 functions
- 230 encrypted strings
- The C2 is stored in an encrypted BaseConfig using XOR
- The DynamicConfig is encrypted using RC4 and "visual decrypt"
- 25 commands

Actors (4)

Name: Evgeniy Mikhailovich Bogachev
- Aliases: Lucky12345, Slavik, Pollingsoon, Monstr, IOO, Nu11
- Addresses: bashorg@talking.cc
Name: Hamza Bendelladj
- Aliases: Bx1, Daniel Hamza, Danielbx1
- Addresses: bx1@hotmail.com, airlord1988@gmail.com, bx1@jabber.org, rozz.scglobal@gmail.com, danieldelcore@gmail.com, bx1@xmpp.org, alertz1@swissjabber.ch, dejavu@thesecure.biz, deja-vu@jabber.org, i_amhere@hotmail.fr, aniel.h.b@universityofsutton.com, princedelune@hotmail.fr, bx1_@msn.com, danibx1@hotmail.fr, danieldelcore@hotmail.com
Name: Yevhen Kulibaba
- Aliases: Jonni
Name: Yuriy Konovalenko
- Aliases: jtk

References (82)

2009-02-09: Introducing: abuse.ch ZeuS Tracker BETA [108]
2010-05-03: A Brief Look at Zeus/Zbot 2.0 [267]
2010-07-30: The “Mumba” Botnet Disclosed [367]
2010-08-10: Cybercriminals Target Online Banking Customers [366]
2010-09-30: 11 people charged following E-Crime Unit investigation [438]
2010-09-30: Manhattan U.S. Attorney Charges 37 Defendants Involved in Global Bank Fraud Schemes that Used “Zeus Trojan” and Other Malware to Steal Millions of Dollars from U.S. Bank Accounts [101]
2010-10-01: Cyber Banking Fraud: Global Partnerships Lead to Major Arrests [429]
2010-10-01: International Cooperation Disrupts Multi-Country Cyber Theft Ring [430]
2010-10-01: Operation Trident BreACH News Briefing [437]
2010-10-24: SpyEye v. ZeuS Rivalry Ends in Quiet Merger [54]
2010-11-10: Zeus 2.1 – Stronger & More Secure, But Will Fraudsters Upgrade? [206]
2010-12-21: The Bozvanovna ZeuS Botnet [246]
2011-01-14: Combined Zeus/SpyEye Toolkit Announced [347]
2011-01-24: Bogus Ad for Zeus-SpyEye Hybrid Trojan published in Underground Forum [348]
2011-01-24: SpyEye/ZeuS Toolkit v1.3.05 Beta [212]
2011-01-31: A Fresh New Hydra Head [346]
2011-02-03: Revisiting the SpyEye/ZeuS Merger [345]
2011-02-04: ZeuS Source Code for Sale. Got $100,000? [344]
2011-02-08: New SpyEye Gains Zeus Features – A Detailed Analysis of SpyEye Trojan v1.3 [210]
2011-03-04: ZeuS lives! [199]
2011-03-09: SpyEye, ZeuS Users Target Tracker Sites [343]
2011-03-23: ZeuS/Zbot source code for sale? [56]
2011-03-31: ZeuS Source Code Already in the Wild [163]
2011-05-09: Complete ZeuS sourcecode has been leaked to the masses [164]
2011-05-10: Fraud News Flash – The Downfall of the Mighty – Zeus Trojan’s Source Code Leaked and Now Available Everywhere [331]
2011-05-11: Fingerprinting the author of the ZeuS Botnet [342]
2011-05-12: What is Zeus? [116]
2011-05-13: 2.0.8.9 Source Code [12]
2011-05-16: Overview: Inside the Zeus Trojan’s source code [378]
2011-08-24: Hybrid Hydras and Green Stealing Machines [341]
2011-09-23: Nikolay Garifulin Pleads Guilty in Manhattan Federal Court to Involvement in Global Bank Fraud Scheme that Used “Zeus Trojan” to Steal Millions of Dollars from U.S. Bank Accounts [427]
2011-09-30: Zeus Trojan Update - new variants based on leaked zeus source code [194]
2011-10-04: Criminal network who targetted internet bank customers convicted [428]
2012-02-17: Zeus Trojan Author Ran With Spam Kingpins [186]
2012-03-23: Another Cyber Fraud Defendant Charged in Operation Aching Mules Sentenced in Manhattan Federal Court [435]
2012-03-24: Zeus Legal Notice [444]
2012-03-25: Microsoft and Financial Services Industry Leaders Target Cybercriminal Operations from Zeus Botnets [122]
2012-03-26: Microsoft Seizes ZeuS Servers in Anti-Botnet Rampage [105]
2012-03-26: MicrosoftDCU, FS-ISAC, and NACHA vs. Zeus [58]
2012-04-12: Critical analysis of Microsoft Operation B71 [302]
2012-04-16: Microsoft Responds to Critics Over Botnet Bruhaha [340]
2012-05-04: Microsoft to Botmasters: Abandon Your Inboxes [339]
2012-06-07: Titans’ revenge: detecting Zeus via its own flaws [387]
2012-06-17: Automating Online Banking FraudAutomatic Transfer System: The Latest Cybercrime Toolkit Feature [304]
2012-06-25: Dissecting Operation High Roller [169]
2012-06-26: Double-Protected Bank Clients Tricked by $78M Crimeware Scam [104]
2012-07-03: Microsoft Names Two Alleged Zeus Botnet Operators [420]
2012-07-03: Relentless Zbot and Anti-emulations [305]
2013-01-10: Police Arrest Alleged ZeuS Botmaster “bx1” [338]
2013-01-21: IceIX/Zeus Red/Zeus [419]
2013-05-03: Alleged 'SpyEye' Botmaster Ends Up in America, Handcuffs [89]
2013-05-03: Alleged SpyEye Seller ‘Bx1’ Extradited to U.S. [337]
2013-09-01: Zeus-R-uS [315]
2014-02-19: A new Zeus variant targeting Salesforce.com – Research and Analysis [241]
2014-03-14: Top Banking Botnets of 2013 [237]
2014-04-12: Zeus Criminals charged in Omaha, Nebraska [309]
2014-05-22: Why Them? Extracting Intelligence about Target Selection from Zeus Financial Malware [388]
2014-06-06: McAfee Labs Threat Advisory: PWS ZBot [390]
2014-12-05: ZeuS meets VM [329]
2015-02-25: FBI: $3M Bounty for ZeuS Trojan Author [204]
2015-04-15: Authorship analysis of the Zeus botnet source code [393]
2015-06-18: The Hunt for the Financial Industry's Most-Wanted Hacker [88]
2015-06-25: Major cybercrime ring dismantled by joint investigation team [431]
2016-03-02: Hamza Bendelladj Sentencing Memorandum [439]
2016-12-29: FACT SHEET: Actions in Response to Russian Malicious Cyber Activity and Harassment [423]
2017-03-21: Inside the Hunt for Russia’s Most Notorious Hacker [185]
2017-04-18: Configuring Zeus: A case study of online crime target selection and knowledge transmission [358]
2017-05-15: Evolution of the GOLD EVERGREEN Threat Group [203]
2019-07-01: Exposing Evgeniy Mikhaylovich Bogachev and the "Jabber ZeuS" Gang - An OSINT Analysis [172]
2019-10-01: Mariposa Botnet Author, Darkcode Crime Forum Admin Arrested in Germany [335]
2019-12-18: Win32/Zeus (alias Zbot) [30]
2019-12-18: win.zeus [28]
2020-01-01: 2.1.0.1 Login [40]
2020-01-01: 2.1.0.1 Panel [41]
2020-01-25: EVGENIY MIKHAILOVICH BOGACHEV [69]
2020-01-26: Zeus (malware) [71]
2021-04-15: 20$ Bounty on Bogachev [283]
2021-05-07: Four Individuals Plead Guilty to RICO Conspiracy Involving “Bulletproof Hosting” for Cybercriminals [425]
2021-07-08: Inside the FBI, Russia, and Ukraine’s failed cybercrime investigation [301]
2021-07-21: The life and death of the ZeuS Trojan [310]
2021-10-20: Two Individuals Sentenced for Providing “Bulletproof Hosting” for Cybercriminals [433]
2022-02-22: EP 111: ZeuS [396]

Version	Count	ITW	IOCs	Reference Sample	Notes
2.0.1.0	1	2012-12-24	Samples	35a2b41ffbd723064445dd16ed0147075bb82a29fdac6ee5b3843a1510b50f02 (VT MB)	Zeus changelog date: 2010-04-28
2.0.1.1	6	2010-08-22	Samples	0f4116098ea8660f6869863c4c1e8891ab708421b483bc55fd544e5b671b792a (VT MB)
2.0.2.0	2	2010-05-26	Samples	c688c3da0b3fe263e2441f884d47966bb74875c94564e7694aa1c462e5c9435f (VT MB)
2.0.2.1	13	2010-05-19	Samples	5d29cc33d90b21321625dca2d097b4d5015b1f4ff955422ea0c51442ac27e1e3 (VT MB)
2.0.2.2	2	2013-05-16	Samples	b0691fde64cadcfc7a521f2fda6975a14e0cdbbd46254950390f7f820310482f (VT MB)
2.0.3.1	6	2010-05-27	Samples	ae68aa53a27732eb0803f205fee19d3ca3e8bce7c0ac03d3fb30ab89a46626de (VT MB)
2.0.4.0	28	2010-06-02	Samples	55412a1f909695ad8ec22a5302142a4c9194bd4c2de98672d41953b620bc2e27 (VT MB)	Zeus changelog date: 2010-05-31
2.0.4.2	5	2010-07-02	Samples	fdc09cef014d9e6543f5ed6f886758d18d9125531488f92138883650f3ac7c3d (VT MB)
2.0.5.0	3	2010-06-22	Samples	f8105c176cdb46bb1feeaf74ea310272dbca379bd82de975b9ab7ac6974af060 (VT MB)	Zeus changelog date: 2010-06-08
2.0.5.1	2	2010-07-20	Samples	36806771db46a4edca45b6b3fad65bab1528dd7f362f29d24c11789b2d0be555 (VT MB)
2.0.5.2	2	2010-07-16	Samples	90bb544cd8ea24b8284bc7c556f4d42fe0a052a48a20cb0b6f818e6d0a8a7a84 (VT MB)
2.0.6.1	19	2010-07-06	Samples	f25dbbf0fa848086e454d05017af1157fe267fc7d7901ca23c0be8bee549426b (VT MB)
2.0.6.2	2	2010-08-19	Samples	4e938d05e96bcf2e22ef498e76f1ce469c6ec3a24f9d8f787eba07c11fb4b3ad (VT MB)
2.0.6.5	2	2010-07-12	Samples	51020390505ecc8cf7045675639937421996529f6d49decc53753e1335aeb574 (VT MB)
2.0.7.0	2260	2010-07-22	Samples	5326134c6251c08ea874332464a9aba3a8a1328b042a1ce3b8c51b0407e4fcf5 (VT MB)	Zeus changelog date: 2010-07-15
2.0.7.1	3	2010-07-25	Samples	7db5dab49e292dc0d82e4ab9d713a6dc9a60b487e192725ff10a174cba39fb52 (VT MB)
2.0.7.4	72	2010-08-09	Samples	24a6c19ce12087f82b0253f92422231801022728d2b909d2fb561bdeb62806db (VT MB)
2.0.7.5	3	2010-08-15	Samples	aadccab126517a622697730983aaee1b8475bd0f16e09b296649ea0740e5ab3c (VT MB)
2.0.8.0	1	2010-10-10	Samples	5b3d4395b0f5acd40bc20f4bf3930cbd14da3d240ad67f7ab9a65de0681e8742 (VT MB)
2.0.8.1	156	2010-09-01	Samples	3738a4a5fc512d44852ab90f7fe37e91159117e484176a06506f41e0db70eae3 (VT MB)
2.0.8.7	17	2010-09-15	Samples	e0d7c01881a50147f93ec0cec80b257bc05fed7a248eba2f2bc03a26e94c3129 (VT MB)
2.0.8.8	3	2010-09-20	Samples	d8ae822e44e2ad95a337f793dae84fa9faef1b0a781eebeeb5f8b028a98001e0 (VT MB)
2.0.8.9	8884	2010-10-17	Samples Samples	0fd0fedc1c314629e83f3e2ef6867e5cbaf15c4bd6235a8d9fadfc79bd441611 (VT MB)
2.0.9.0	55	2011-01-19	Samples	14c31678230e8848e0e385b5554904bf6df8199fb1bdb63f9f7a09127c72ea2c (VT MB)
2.0.9.1	66	2011-03-05	Samples	0d96c8a11fe748d1258fc20378d3e354fd468dd7ba9d07670497024b6fb03406 (VT MB)
2.0.9.3	2	2011-10-28	Samples	7eb392d4b51cd57ebb4a89200f6fc14ec7f7c5fa8029c4369bb84935ce7a5d57 (VT MB)
2.0.9.5	3	2012-10-28	Samples	41ea373c7a57eb0c9103d7b4edb4cc2a381f80cfff02dfe704f851ae8722853e (VT MB)
2.0.9.9	3	2012-02-05	Samples	0a98d7b4d1079a8819a6bd0898de2e00a5598c1e5233aa095bea36a18353b4bb (VT MB)
2.1.0.0	80	2011-04-01	Samples	1f3842bc152088bc10de6e14adabf860902dee318375a6567e0b85a9faaed1f0 (VT MB)	Zeus changelog date: 2011-03-02
2.1.0.1	3390	2011-03-24	Samples	0bde61b11f4d507d3a6f5ebfdb33829824f4819f1621f4a1f36f6d0edef0d6c2 (VT MB)
2.1.0.2	16	2011-07-12	Samples	857dcf87ce9465da45451d75d0c780115b543b004992117e48c9d9498ddee64a (VT MB)
2.1.0.3	1	2011-12-23	Samples	f55d6bd5f13356eda64fae070a5eee1a080f06a0aa69bdd7e137496d88346be3 (VT MB)
2.1.0.4	2	2011-12-20	Samples	8ae8e3bb7106e318c4ab4f6dd0cbe79a63485531a91b4e86e15fec556ccf8e60 (VT MB)
2.1.0.5	9	2012-02-08	Samples	fb413e293d5cc9f5b0cef6328221ab9888fd61f9898935fad11c2afb42f4ee12 (VT MB)

curator@zeusmuseum.com / @tildedennis