ZeuS
ZeuS is a bot software. Take a look at my friends ZeuS Tracker https://zeustracker.abuse.ch/
Weeks ago I got an original ZeuS package (1.2.1.6 version). Take a look on its users guide:
==============
= Contents =
==============
1. Description and facilities.
2. Setting up the server.
2.1. HTTP-server.
2.2. The interpreter PHP.
2.3. MySQL-server.
3. Setting Bot.
4. History.
5. TODO.
6. F.A.Q.
7. Myths.
==============================
= 1. Description and facilities. =
==============================
ZeuS - software to steal personal user data from remote systems, Windows. On
plain language of "Troy", "backdoor", "virus". But the author does not like these words, therefore, further documentation
He will call this software "Bot".
Boat is fully based on the WinAPI Interception in UserMode (Ring3), this means that the bot does not use
no drivers or downloads in Ring0. This feature makes it possible to run even from Bota
Guest Account Windows. Plus, it ensures greater stability and adaptability
subsequent versions of Windows.
Bot is developed in Visual C + + version 9.0 +, with no additional libraries are used
Type msvcrt, ATL, MFC, QT, etc. Bot code is written with the following priorities (in descending order):
1. stability (carefully checked all the results of the call functions, etc.)
2. size (to avoid duplication of algorithms, repetitive calls, functions, etc.)
3. speed (not the type of instruction while (1 ){..}, for (int i = 0; i server. It may decrease the load on the server.
459905217 (15:47:57 5/03/2009)
Boat:
[-] Fixed the bug that blocking bots on limited screen Windows.
[*] Written a new PE-kriptor now PE-file is very accurate and the most
simulates the results of the MS Linker 9.0.
[*] Updated build process to bildere Bot.
[*] Optimized compression of the configuration file.
[*] The new format is a binary configuration file.
[*] Rewritten the process of assembling the binary config file.
[*] Socks and LC are now working on a port.
Control Panel:
[*] The status of the control panel, transferred to the BETA.
[*] Changed all tables MySQL.
[*] Nachet a gradual transfer of the Control Panel on the UTF-8 (may be temporary problems with
displaying characters).
[*] Updated geobaza.
[Version 1.2.1.0, 30.12.2008]
Boat:
[*] BOFA Answers are now sent as BLT_GRABBED_HTTP (was BLT_HTTPS_REQUEST).
[-] Small error when sending reports.
[-] The size of the report could not exceed ~ 550 characters.
[-] Error exists since the beginning of the bot: a low timeout for sending POST-requests
resulting in a blocked sending long (more than ~ 1 Mb) Report on slow
compounds (not stable), as the theoretical implications - bot altogether stopped sending
Records.
Overall:
[+] In the case record and record type BLT_HTTP_REQUEST BLT_HTTPS_REQUEST field SBCID_PATH_SOURCE
(in the table will path_source) added path URL.
Control Panel:
[*] Updated redir.php.
============
= 2. TODO. =
============
1. Complete work in Windows Vista/2008/Seven.
2. Changing the method of intercepting WinAPI.
3. Random generation: the names of files, settings and data.
4. Console bilder.
5. x64 version.
6. Support for IPv6.
7. Writing full documentation.
8. Collecting statistics using software (antivirus, firewall, etc.).
9. Interception of FireFox 3 +.
=============
= 4. F.A.Q. =
=============
Q: When it all began?
A: distant summer of 2006, when his hands got glyuchny "VisualBreeze e-Banca". Then there
the desire to write something with the same opportunities,
(05:11:25 23/01/2009)
but not c such glyuchnostyu, and no such
size. In general, dev, thanks for the sample;)
Q: What the numbers mean in the version of ZeuS?
A: a.b.c.d
a - a complete change in your bot.
b - the major changes that cause complete or partial incompatibility with previous
versions Bot.
c - correct errors, refine, add features.
d - Number of AV to clean the current version of abc
Q: How obrozom generated Bot ID?
A: Bot ID consists of two parts:% name% _% number%, where the name - the name of the computer (the result of
GetComputerName), a number - a certain number that is generated based on unique data nekotryh OS.
===========
= 5. Myths =
===========
M: ZeuS uses a DLL to work.
A: False. There is only one executable PE file (exe). Dll, sys, etc. not when there was no
vryatli will ever be. This myth has gone due to the fact that in some version for bot
storage configuration used for files with such extensions.
M: ZeuS uses COM (BHO) for the interception of Internet Explorer.
A: False. Always use this for intercepting WinAPI of wininet.dll.
The original package contained following files:
C:\Users\Peter Kleissner\Desktop\Analyses\Analysis of ZeuS\1.2.1.6\zeus 1.2.1.6>tree /F
Auflistung der Ordnerpfade für Volume
Volumeseriennummer :
C:.
│ 1.2.1.6.exe
│ hlp.txt
│
└───server[php]
│ in.php
│ index.php
│ redir.php
│ s.php
│
├───.install
│ geobase.txt
│ index.php
│
├───system
│ en.bcmds.lng.php
│ en.bots.lng.php
│ en.dblogs.lng.php
│ en.dbtlogs.lng.php
│ en.lfiles.lng.php
│ en.lng.php
│ en.login.lng.php
│ en.options.lng.php
│ en.stats.lng.php
│ en.user.lng.php
│ en.users.lng.php
│ global.php
│ mod.bcmds.php
│ mod.bots.php
│ mod.dblogs.php
│ mod.dbtlogs.php
│ mod.lfiles.php
│ mod.login.php
│ mod.options.php
│ mod.stats.php
│ mod.user.php
│ mod.users.php
│ ru.bcmds.lng.php
│ ru.bots.lng.php
│ ru.dblogs.lng.php
│ ru.dbtlogs.lng.php
│ ru.lfiles.lng.php
│ ru.lng.php
│ ru.login.lng.php
│ ru.options.lng.php
│ ru.stats.lng.php
│ ru.user.lng.php
│ ru.users.lng.php
│
└───theme
html.php
menu.js
style.css
You may download the original version (cyrillic) of the users guide under http://web17.webbpro.de/downloads/ZeuS/hlp.pdf.
^ Top
Last modified: 12 April 2009
Previous page: Analysing the PDF Exploit
Next page: infobox.ru: Botnet