[Xylitol]

Citadel samples by version:
Citadel 1.3.4.0
Citadel 1.3.4.5
Citadel 1.3.5.1
Citadel 1.2.0.0
Citadel 3.1.0.0
Atmos 0.0.1.1

Related materials:
Backdoor.Citadel.BkCnct
Hacktool.Citadel.Builder
Troj.ZbotPHP-A

Microsoft lawsuit against Citadel botherders: >>146519568

For 1.2.0.0 and 3.1.0.0 those are *private* version of Citadel, if you look for ressources:
S21Sec: Citadel hasn't gone
S21sec: Citadel "involution"
S21sec: Zeus-Я-uS
S21sec: ZeuS timeline 2
Hexacorn: Zeus trivia

Atmos, version 0.0.1.0 and 0.0.1.1:
JPCERT: Banking Trojan “Citadel” Returns

[sleeper]

New Zeus Clone.

Was featured by Brian Krebs and seems to have some interesting Features (see here).

Anybody got a sample?

[Flopik]

Im interested in a sample too

[Xylitol]

Sample old ~15 Jan

[Flopik]

Thanks!

Sample old ~15 Jan

[sleeper]

Sample old ~15 Jan

Thank you :)

[Evilcry]

Citadel 1.3
http://cyb3rsleuth.blogspot.co.uk/2012/ ... el-13.html

[erikloman]

omroepzeeland.nl briefly served Citadel through its frontpage (via java exploit).
http://nos.nl/artikel/356996-site-omroe ... keerd.html

Find fresh sample attached.
https://www.virustotal.com/file/e7256e3 ... /analysis/

[EP_X0FF]

http://themalwarelab.blogspot.com.es/20 ... v1340.html



:D

[Xylitol]

Citadel C&C appeared today on ZeuS tracker, so far no sample.

Code: Select all

http://188.162.10.19/cp.php?m=login
http://188.162.10.19/file.php
http://188.162.10.19/api.php
http://188.162.10.19/gate.php
http://188.162.10.19/theme/style.css
http://188.162.10.19/theme/images/citadel.jpg
http://188.162.10.19/images/
http://188.162.10.19/files/
http://188.162.10.19/public/
http://188.162.10.19/system/