SYMBOLCOMMON_NAMEaka. SYNONYMS
win.zeus (Back to overview)

Zeus

aka: Zbot
VTCollection     URLhaus      

According to CrowdStrike, The two primary goals of the Zeus trojan horse virus are stealing people's financial information and adding machines to a botnet. Unlike many types of malware, most Zeus variants try to avoid doing long-term damage to the devices they infect. Their aim is to avoid detection from antivirus software.

References
2024-02-15 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
Zeus, IcedID malware gangs leader pleads guilty, faces 40 years in prison
Egregor IcedID Maze Zeus
2024-02-15 ⋅ Department of Justice ⋅ Office of Public Affairs
Foreign National Pleads Guilty to Role in Cybercrime Schemes Involving Tens of Millions of Dollars in Losses
Egregor IcedID Maze Zeus
2023-03-14 ⋅ CrowdStrike ⋅ CrowdStrike
The Zeus Trojan Malware - Definition and Prevention
Zeus
2022-11-15 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Top Zeus Botnet Suspect “Tank” Arrested in Geneva
Zeus
2022-10-31 ⋅ paloalto Netoworks: Unit42 ⋅ Or Chechik
Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure
Dridex Kronos TrickBot Zeus
2022-04-15 ⋅ Center for Internet Security ⋅ CIS
Top 10 Malware March 2022
Mirai Shlayer Agent Tesla Ghost RAT Nanocore RAT SectopRAT solarmarker Zeus
2022-02-11 ⋅ Cisco Talos ⋅ Talos
Threat Roundup for February 4 to February 11
DarkComet Ghost RAT Loki Password Stealer (PWS) Tinba Tofsee Zeus
2021-09-09 ⋅ Recorded Future ⋅ Insikt Group
Dark Covenant: Connections Between the Russian State and Criminal Actors
BlackEnergy EternalPetya Gameover P2P Zeus
2021-09-03 ⋅ Trend Micro ⋅ Mohamad Mokbel
The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-07-21 ⋅ Malwarebytes ⋅ Malwarebytes
The life and death of the ZeuS Trojan
Zeus
2021-07-01 ⋅ Kryptos Logic ⋅ Kryptos Logic Vantage Team
TrickBot and Zeus
TrickBot Zeus
2021-05-07 ⋅ Department of Justice ⋅ Office of Public Affairs
Four Individuals Plead Guilty to RICO Conspiracy Involving “Bulletproof Hosting” for Cybercriminals
Citadel SpyEye Zeus
2021-04-02 ⋅ NRC Handelsblad ⋅ Carola Houtekamer, Rik Wassens
The cesspool of the internet is to be found in a village in North Holland
Zeus
2021-03-31 ⋅ Kaspersky SAS ⋅ Kaspersky
Financial Cyberthreats in 2020
BetaBot DanaBot Emotet Gozi Ramnit RTM SpyEye TrickBot Zeus
2021-01-01 ⋅ Secureworks ⋅ SecureWorks
Threat Profile: GOLD EVERGREEN
CryptoLocker Pony Zeus GOLD EVERGREEN
2020-12-10 ⋅ US-CERT ⋅ FBI, MS-ISAC, US-CERT
Alert (AA20-345A): Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data
PerlBot Shlayer Agent Tesla Cerber Dridex Ghost RAT Kovter Maze MedusaLocker Nanocore RAT Nefilim REvil Ryuk Zeus
2020-08-09 ⋅ F5 Labs ⋅ Debbie Walkowski, Remi Cohen
Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2020-07-17 ⋅ CERT-FR ⋅ CERT-FR
The Malware Dridex: Origins and Uses
Andromeda CryptoLocker Cutwail DoppelPaymer Dridex Emotet FriedEx Gameover P2P Gandcrab ISFB Murofet Necurs Predator The Thief Zeus
2020-02-25 ⋅ RSA Conference ⋅ Joel DeCapua
Feds Fighting Ransomware: How the FBI Investigates and How You Can Help
FastCash Cerber Defray Dharma FriedEx Gandcrab GlobeImposter Mamba Phobos Rapid Ransom REvil Ryuk SamSam Zeus
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
BRONZE WOODLAND
PlugX Zeus Roaming Tiger
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
GOLD EVERGREEN
CryptoLocker Pony Zeus
2019-12-19 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Inside ‘Evil Corp,’ a $100M Cybercrime Menace
Dridex Gameover P2P Zeus Evil Corp
2017-11-02 ⋅ Anomali ⋅ Anomali
Country Profile: Russian Federation
Zeus
2017-05-15 ⋅ Secureworks ⋅ Counter Threat Unit ResearchTeam
Evolution of the GOLD EVERGREEN Threat Group
CryptoLocker Dridex Dyre Gameover P2P Murofet TrickBot Zeus GOLD EVERGREEN
2017-03-21 ⋅ Wired ⋅ Chad Hagen, Garrett M. Graff
Inside the Hunt for Russia’s Most Notorious Hacker
Gameover P2P Murofet Zeus
2014-07-02 ⋅ Trend Micro ⋅ Kervin Alintanahin, Ronnie Giagone
KIVARS With Venom: Targeted Attacks Upgrade with 64-bit “Support”
FakeWord KIVARS PLEAD Poison RAT Zeus
2012-12-24 ⋅ Contagio Dump ⋅ Mila Parkour
Dec 2012 Linux.Chapro - trojan Apache iframer
Chapro Zeus
2010-09-07 ⋅ S21sec ⋅ Mikel Gastesi
ZeuS: The missing link
Zeus
2010-08-01 ⋅ Contagio Dump ⋅ Mila Parkour
Zeus Trojan Research Links
Zeus
2010-07-24 ⋅ Sophos ⋅ James Wyke
Why won’t my sample run?
Zeus
2010-07-14 ⋅ Contagiodump Blog ⋅ Mila Parkour
ZeuS Version scheme by the trojan author
Zeus
2010-05-03 ⋅ Symantec ⋅ Karthik Selvaraj
A Brief Look at Zeus/Zbot 2.0
Zeus
2010-04-26 ⋅ Symantec ⋅ Peter Coogan
SpyEye’s "Kill Zeus" Bark is Worse Than its Bite
Zeus
2010-04-19 ⋅ MalwareIntelligence ⋅ Jorge Mieres
ZeuS on IRS Scam remains actively exploited
Zeus
2010-03-15 ⋅ MalwareIntelligence ⋅ MalwareIntelligence
New phishing campaign against Facebook led by Zeus
Zeus
2010-03-10 ⋅ Secureworks ⋅ Don Jackson, Kevin Stevens
ZeuS Banking Trojan Report
Zeus
2010-02-20 ⋅ MalwareIntelligence ⋅ Jorge Mieres
Facebook & VISA phishing campaign proposed by ZeuS
Zeus
2010-02-02 ⋅ EternalTODO Blog ⋅ Jose Miguel Esparza
ZeuS spreading via Facebook
Zeus
2010-01-25 ⋅ Ernesto Martin
Leveraging ZeuS to send spam through social networks
Zeus
2010-01-01 ⋅ Mandiant ⋅ Ero Carrera, Peter Silberman
State of Malware: Family Ties
Bredolab Conficker Cutwail KoobFace Oderoor Poison Ivy Rustock Sinowal Szribi Zeus
2009-11-06 ⋅ Eternal Todo ⋅ Jose Miguel Esparza
New ZeuS binary
Zeus
2009-10-01 ⋅ Eternal Todo ⋅ Jose Miguel Esparza
Detecting ZeuS
Zeus
2009-07-11 ⋅ MalwareIntelligence ⋅ MalwareIntelligence
Special!!! ZeuS Botnet for Dummies
Zeus
2009-01-01 ⋅ Symantec ⋅ Eric Chien, Nicolas Falliere
Zeus: King of the Bots
Zeus
2006-11-13 ⋅ Secure Science Corporation ⋅ Micael Ligh
Malware Case Study - ZeusMalware
Zeus
Yara Rules
[TLP:WHITE] win_zeus_auto (20260917 | Detects win.zeus.)
rule win_zeus_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.zeus."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb58 833f00 7651 8b5f08 }
            // n = 4, score = 700
            //   eb58                 | jmp                 0x5a
            //   833f00               | cmp                 dword ptr [edi], 0
            //   7651                 | jbe                 0x53
            //   8b5f08               | mov                 ebx, dword ptr [edi + 8]

        $sequence_1 = { 8b4804 81e1000000e0 394c240c 740d }
            // n = 4, score = 600
            //   8b4804               | mov                 ecx, dword ptr [eax + 4]
            //   81e1000000e0         | and                 ecx, 0xe0000000
            //   394c240c             | cmp                 dword ptr [esp + 0xc], ecx
            //   740d                 | je                  0xf

        $sequence_2 = { c6451700 8b5d10 3bde 7503 8d5d10 39750c }
            // n = 6, score = 600
            //   c6451700             | mov                 byte ptr [ebp + 0x17], 0
            //   8b5d10               | mov                 ebx, dword ptr [ebp + 0x10]
            //   3bde                 | cmp                 ebx, esi
            //   7503                 | jne                 5
            //   8d5d10               | lea                 ebx, [ebp + 0x10]
            //   39750c               | cmp                 dword ptr [ebp + 0xc], esi

        $sequence_3 = { 8d7708 8975fc e8???????? 8d4720 }
            // n = 4, score = 600
            //   8d7708               | lea                 esi, [edi + 8]
            //   8975fc               | mov                 dword ptr [ebp - 4], esi
            //   e8????????           |                     
            //   8d4720               | lea                 eax, [edi + 0x20]

        $sequence_4 = { eb21 ff7514 8bc6 57 }
            // n = 4, score = 600
            //   eb21                 | jmp                 0x23
            //   ff7514               | push                dword ptr [ebp + 0x14]
            //   8bc6                 | mov                 eax, esi
            //   57                   | push                edi

        $sequence_5 = { 84c0 7467 8b5d10 83e301 33ff 3bdf }
            // n = 6, score = 600
            //   84c0                 | test                al, al
            //   7467                 | je                  0x69
            //   8b5d10               | mov                 ebx, dword ptr [ebp + 0x10]
            //   83e301               | and                 ebx, 1
            //   33ff                 | xor                 edi, edi
            //   3bdf                 | cmp                 ebx, edi

        $sequence_6 = { 8d7708 83c720 57 8d45f4 50 8d45f8 50 }
            // n = 7, score = 600
            //   8d7708               | lea                 esi, [edi + 8]
            //   83c720               | add                 edi, 0x20
            //   57                   | push                edi
            //   8d45f4               | lea                 eax, [ebp - 0xc]
            //   50                   | push                eax
            //   8d45f8               | lea                 eax, [ebp - 8]
            //   50                   | push                eax

        $sequence_7 = { e8???????? 8b4808 8b32 8d4c3110 81f90000a000 7715 8918 }
            // n = 7, score = 600
            //   e8????????           |                     
            //   8b4808               | mov                 ecx, dword ptr [eax + 8]
            //   8b32                 | mov                 esi, dword ptr [edx]
            //   8d4c3110             | lea                 ecx, [ecx + esi + 0x10]
            //   81f90000a000         | cmp                 ecx, 0xa00000
            //   7715                 | ja                  0x17
            //   8918                 | mov                 dword ptr [eax], ebx

        $sequence_8 = { 891d???????? 891d???????? ffd6 68???????? }
            // n = 4, score = 500
            //   891d????????         |                     
            //   891d????????         |                     
            //   ffd6                 | call                esi
            //   68????????           |                     

        $sequence_9 = { e8???????? 84c0 7442 6a10 }
            // n = 4, score = 500
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   7442                 | je                  0x44
            //   6a10                 | push                0x10

        $sequence_10 = { 8bf3 6810270000 ff35???????? ff15???????? }
            // n = 4, score = 500
            //   8bf3                 | mov                 esi, ebx
            //   6810270000           | push                0x2710
            //   ff35????????         |                     
            //   ff15????????         |                     

        $sequence_11 = { 8d8db0fdffff e8???????? 8ad8 84db }
            // n = 4, score = 400
            //   8d8db0fdffff         | lea                 ecx, [ebp - 0x250]
            //   e8????????           |                     
            //   8ad8                 | mov                 bl, al
            //   84db                 | test                bl, bl

        $sequence_12 = { c20400 55 8bec f6451802 }
            // n = 4, score = 300
            //   c20400               | ret                 4
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   f6451802             | test                byte ptr [ebp + 0x18], 2

        $sequence_13 = { 56 ff15???????? 5e 8ac3 5b c20800 55 }
            // n = 7, score = 300
            //   56                   | push                esi
            //   ff15????????         |                     
            //   5e                   | pop                 esi
            //   8ac3                 | mov                 al, bl
            //   5b                   | pop                 ebx
            //   c20800               | ret                 8
            //   55                   | push                ebp

        $sequence_14 = { 8d75a8 b8d5000000 e8???????? 68e6010000 68???????? 6809080002 }
            // n = 6, score = 200
            //   8d75a8               | lea                 esi, [ebp - 0x58]
            //   b8d5000000           | mov                 eax, 0xd5
            //   e8????????           |                     
            //   68e6010000           | push                0x1e6
            //   68????????           |                     
            //   6809080002           | push                0x2000809

        $sequence_15 = { b9???????? 56 57 33f6 56 50 68???????? }
            // n = 7, score = 200
            //   b9????????           |                     
            //   56                   | push                esi
            //   57                   | push                edi
            //   33f6                 | xor                 esi, esi
            //   56                   | push                esi
            //   50                   | push                eax
            //   68????????           |                     

        $sequence_16 = { 6809080002 8bc6 50 8d45fc 50 e8???????? }
            // n = 6, score = 200
            //   6809080002           | push                0x2000809
            //   8bc6                 | mov                 eax, esi
            //   50                   | push                eax
            //   8d45fc               | lea                 eax, [ebp - 4]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_17 = { eb18 81fb5a5c4156 740c 81fb45415356 }
            // n = 4, score = 200
            //   eb18                 | jmp                 0x1a
            //   81fb5a5c4156         | cmp                 ebx, 0x56415c5a
            //   740c                 | je                  0xe
            //   81fb45415356         | cmp                 ebx, 0x56534145

        $sequence_18 = { 894736 8d470c 50 c707000e0000 c7470809080002 e8???????? 83674200 }
            // n = 7, score = 200
            //   894736               | mov                 dword ptr [edi + 0x36], eax
            //   8d470c               | lea                 eax, [edi + 0xc]
            //   50                   | push                eax
            //   c707000e0000         | mov                 dword ptr [edi], 0xe00
            //   c7470809080002       | mov                 dword ptr [edi + 8], 0x2000809
            //   e8????????           |                     
            //   83674200             | and                 dword ptr [edi + 0x42], 0

        $sequence_19 = { 3d59495351 0f85ca000000 807b0420 0f85c0000000 33c0 83c6fb }
            // n = 6, score = 200
            //   3d59495351           | cmp                 eax, 0x51534959
            //   0f85ca000000         | jne                 0xd0
            //   807b0420             | cmp                 byte ptr [ebx + 4], 0x20
            //   0f85c0000000         | jne                 0xc6
            //   33c0                 | xor                 eax, eax
            //   83c6fb               | add                 esi, -5

        $sequence_20 = { 83fe06 0f86e3000000 8b03 3509080002 3d5c5b4550 }
            // n = 5, score = 200
            //   83fe06               | cmp                 esi, 6
            //   0f86e3000000         | jbe                 0xe9
            //   8b03                 | mov                 eax, dword ptr [ebx]
            //   3509080002           | xor                 eax, 0x2000809
            //   3d5c5b4550           | cmp                 eax, 0x50455b5c

        $sequence_21 = { 84c0 0f84ac000000 b809080002 3945f4 7713 807d0801 }
            // n = 6, score = 200
            //   84c0                 | test                al, al
            //   0f84ac000000         | je                  0xb2
            //   b809080002           | mov                 eax, 0x2000809
            //   3945f4               | cmp                 dword ptr [ebp - 0xc], eax
            //   7713                 | ja                  0x15
            //   807d0801             | cmp                 byte ptr [ebp + 8], 1

        $sequence_22 = { 83fe04 0f82ec000000 8b1b 81f309080002 }
            // n = 4, score = 200
            //   83fe04               | cmp                 esi, 4
            //   0f82ec000000         | jb                  0xf2
            //   8b1b                 | mov                 ebx, dword ptr [ebx]
            //   81f309080002         | xor                 ebx, 0x2000809

    condition:
        7 of them and filesize < 319488
}
Download all Yara Rules