The malware first called Zbot, short for ZeuS Bot, later became known simply as ZeuS.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“now it was being called Zbot, short for ZeuS Bot”
“By 2008, Zbot became known just as ZeuS”
Malware
malware:zeus
Also: ZeuS Bot, Zeus
Banking Trojan and crimeware kit used to steal credentials, control infected computers, operate botnets, and facilitate fraudulent bank transfers.
Banking Trojan and crimeware kit used to steal credentials, control infected computers, operate botnets, and facilitate fraudulent bank transfers.
“By 2008, Zbot became known just as ZeuS”
“ZeuS was different. Slavik was using it himself to rob people, but he also built ZeuS to be a crimeware kit”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DEVELOPED_BY | Slavik | Explicit | 111 |
| outgoing | USES | malware as a service | Explicit | 111 |
| outgoing | USES | Cutwail | Explicit | 111 |
| outgoing | USES | ZeuS Builder | Explicit | 111 |
| outgoing | USES | man-in-the-browser attack | Explicit | 111 |
| incoming | SAME_AS | Zbot | Explicit | 111 |
| incoming | VARIANT_OF | JabberZeuS | Explicit | 111 |
| incoming | VARIANT_OF | ZeuS V2 | Explicit | 111 |
| incoming | USES | Rock Phish | Explicit | 111 |
| incoming | USES | Avalanche | Explicit | 111 |
| incoming | VARIANT_OF | SpyEye | Explicit | 111 |
The malware first called Zbot, short for ZeuS Bot, later became known simply as ZeuS.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“now it was being called Zbot, short for ZeuS Bot”
“By 2008, Zbot became known just as ZeuS”
Jack identifies Slavik as the author and mastermind behind ZeuS.
Explicit Confidence 96% · Jack Rhysider EP 111 Details
“That author was the young Russian going by the name of Slavik”
“Slavik had used many different usernames on the web, but he was often seen talking about ZeuS, and took ownership as the author”
ZeuS USES malware as a service
ZeuS Version 3 was offered as malware as a service.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“ZeuS Version 3, and it was the first online banking malware to be offered as a service, MAAS, malware as a service”
JabberZeuS VARIANT_OF ZeuS
JabberZeuS was presented as the next major version of ZeuS, with additional modules and features.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“wrote the next big version of ZeuS. This would be called JabberZeuS”
ZeuS V2 was a later version of ZeuS with expanded surveillance and banking capabilities.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“He went on to add even more new features and came out with ZeuS V2”
Rock Phish USES ZeuS
Rock Phish added ZeuS to its phishing operations and pushed it with phishing emails.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“by 2008, they were adding ZeuS to their arsenal”
“Rock Phish began pushing the ZeuS malware out along with their phishing e-mails”
Avalanche used ZeuS as a credential thief and botnet.
Explicit Confidence 95% · Jack Rhysider EP 111 Details
“Avalanche liked ZeuS too”
The transcript says ZeuS and Cutwail were integrated with each other, combining their capabilities.
Explicit Confidence 98% · Jack Rhysider EP 111 Details
“The Cutwail botnet, along with its friendly loader Pushdo, eventually integrated ZeuS into it, and ZeuS integrated Cutwail into it”
ZeuS USES ZeuS Builder
The ZeuS crimeware kit included ZeuS Builder, which configured the behavior of bots.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“the ZeuS crimeware kit came with ZeuS Builder”
ZeuS USES man-in-the-browser attack
ZeuS could conduct man-in-the-browser attacks by altering rendered web pages and requesting additional sensitive information.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“ZeuS was able to carry out man-in-the-browser attacks”
SpyEye was made by modifying ZeuS.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“Gribodemon and Harderman took ZeuS and modified it to make a new malware called SpyEye”