[a_d_13]

Hello,

The people at ThreatExpert recently released a config file decryptor for ZeuS 2.0.
Writeup: http://blog.threatexpert.com/2010/05/co ... us-20.html
Download: http://www.threatexpert.com/blog/zbot/zeusdecoder.zip

Enjoy :)

Thanks,
--AD

[pigindrin]

Hello, i tried to decrypt a sample of zeus but i couldn´t. Could you? If so, can you help me to decrypt the file I attached? It is a sample of zeus.

Thk!

[Evilcry]

This tool does not work for all ZeuS situations, the best approaches to achieve rapidly results are

-> Debugging, like this traversecode.com/2009/12/31/decrypting-the-zeus-config-file/ (reach it via google webcache)
-> Process Memory Dump, simulate infection, run firefox and dump its process memory (does not works always)
-> Via Volatility, here tutorial and plugins http://mnin.blogspot.com/2011/09/abstra ... -zeus.html