Zeus Botnet. The missing manual

Description

Abstract Putting the completely unoriginal title aside, the purpose of this document is to introduce the reader to the ZeuS bot. This paper specifically addresses version 1.2.4.2. Be forewarned that some of the information here is cursory or incomplete. In other cases, your research may show that my interpretation or findings were completely wrong. Please let me know so that I can update this documentation. I can be reached at [email protected] Along with a basic introduction, I’ll include the essential information required to install a ZeuS infrastructure, configure and install a bot, describe the various functions available in the ZeuS Control Panel, and explain the BackConnect functionality that was incorporated into ZeuS 1.2.4.2. This paper will not directly discuss the ethics regarding the operation of botnets nor will it cover the methods used to distribute the bot installer. It also is not intended to be an authoritative reverse engineering attempt of the bot. Ultimately, this guide is meant as a primer to help fellow researchers jumpstart their own investigations by setting up a viable test environment and providing you with an understanding of how the pieces operate. Don’t be intimidated by the length of the document; more than half of it is screenshots with some type of explanation. I wanted to provide screenshots in addition to some narrative because some people may not actually be able to run through the exercise.