ZeusVM Bits and Pieces Naming Versions

More documents

Recommendations

Info

In response to the POST, the Citadel command and control server returns the config:
The config is encrypted using three layers: AES, XOR, and visual encrypt. The first is a layer of AES-‐128 in ECB mode (using a generated AES key). Second is a basic XOR with the bytes of the previously mentioned login key and the last layer is visual decrypt. Once decrypted, the config is presented in the binstorage format using config specific data types. Retrieving the Command and Control Config in ZeusVM As hinted by the command and control URL (hXXps://arrowtools.ru/xEZNzZEQuj8vJwsZ/flashplayer.jpg), this ZeusVM sample requests a .jpg over an HTTPS GET request. While not every sample uses TLS, every sample does request a .jpg file. The file is a legitimate JPEG that can be properly rendered:
Page 1 and 2: ZeusVM: Bits and Pieces By Den
Page 3 and 4: Within the ZeusVM executable it
Page 5 and 6: After extracting the version fr
Page 7 and 8: Decrypting the Base Config in
Page 9 and 10: Next, the handler is implemente
Page 11 and 12: The rough outline of the code
Page 13 and 14: 1. 26 - instr_setedx_SHORT 2. 26
Page 15 and 16: esearchers. Querying ASERT’s 2
Page 17 and 18: This sample has the RC6 key s
Page 19: Removing the layers of encrypti
Page 23 and 24: This data starts 14 bytes from
Page 25 and 26: Version 2.0.14.0 decrypts the c
Page 27 and 28: While this is only the first
Page 29 and 30: The contents of these extra, f

ZeusVM Bits and Pieces Naming Versions

Create successful ePaper yourself

Delete template?

Save as template?