Zeus has been kicking around for at least 3 years now, and due to its age I often find myself applying this sort of fuzzy, whitewash filter over news or other media reports discussing it. I found it refreshing then when @justin_foster shared this TrendMicro PDF on twitter this evening that goes through the malware’s capabilities in a clear and concise format.
Good read (except for the very final few statements about the battle and fighting and such – listen AV vendors – we know you guys are fighting this WAR against viruses.. just .. quit with the emotion and reminding us of it so we can go back to worrying about all the other things).
Whilst discussing this paper with a friend he also pointed out Symantec’s Zeus report [PDF], whilst a little bit more dated, it perhaps contains more technical information.
If you’re more interested in how Zeus encrypts its config files you can go here.
And look, whilst I’m spamming the crud out of you guys make sure you’re following the Damballa blog too! They talk about this sort of stuff all the time.
Tags: botnet, fraud, malware, scam, Security