A forum for reverse engineering, OS internals and malware analysis 

Win32/Zeus (alias Zbot)

Forum for analysis and discussion about malware.

Re: Trojan Zeus (alias ZBot)

 #12662  by EP_X0FF
 Fri Apr 13, 2012 7:03 am
Not really, it was expected to something like this will appear. Kelihos sinkholing also criticized by homemade security "experts". It is always pretty cool criticise others work when yourself you doing nothing and hiding this under the "private converstations" 600+ length words BS blogposts.

PWS:Win32/Zbot.gen!AF: Another varient of Zbot

 #12941  by leeno
 Sun Apr 29, 2012 5:23 pm
Hi Guys ,

I came across a zbot sample as flagged by virustotal. But this sample is not even citadel/ice 9 or old zeus .
any one help in identifying it correctly .

lots of encrypted UDP only trafffic .

https://www.virustotal.com/file/0a7adf0 ... /analysis/

Thanks

Leeno
Attachments
(254.36 KiB) Downloaded 62 times

Re: PWS:Win32/Zbot.gen!AF: Another varient of Zbot

 #12945  by rkhunter
 Sun Apr 29, 2012 8:11 pm
Don't think that this is new, I saw it at least 4 month ago. Why you decided that this is different version of ZBot?
FYI: http://www.microsoft.com/security/porta ... bot.gen!AF
Encyclopedia entry
Updated: Sep 19, 2011 | Published: Jun 29, 2011
PWS:Win32/Zbot.gen!AF is a generic detection for variants of PWS:Win32/Zbot, a password stealing trojan.

Re: Trojan Zeus (alias ZBot)

 #12960  by EP_X0FF
 Mon Apr 30, 2012 1:56 pm
thisisu wrote:
rkhunter wrote:Critical analysis of Microsoft Operation B71 (against ZBot/Zeus/SpyEye botnet)
http://blog.fox-it.com/2012/04/12/criti ... ation-b71/
"One of the botnets was up and running again within 24 hours of the takedown on a brand new c&c server and continued with its business as usual."

Is this true?
When you are running botnet and really thinking about it security you always have a plan B. Backup/alternative C&C servers, and maybe reserved bot version (Kelihos example). Only a complete takedown combined with law enforcement actions can guarantee that botnet is really dead at forever. So it is not a something unusual, or a fault from Microsoft. Authors of this article should do something instead of searching for mistakes in others actions.
  • 1
  • 8
  • 9
  • 10
  • 11
  • 12
  • 29
 Return to “Malware”