{"id":1411,"date":"2012-10-26T17:11:28","date_gmt":"2012-10-26T17:11:28","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=1411"},"modified":"2012-11-06T12:57:56","modified_gmt":"2012-11-06T12:57:56","slug":"zeus-trivia","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2012\/10\/26\/zeus-trivia\/","title":{"rendered":"Zeus trivia"},"content":{"rendered":"

Update<\/strong><\/p>\n

After another chat (with @push_pnx, Thanks!), one more clarification – it appears to be a sample from a Citadel family – a spinoff from Zeus src code that is developed further by most likely a different programming group.<\/p>\n

Interestingly, the distinction between families is not easy as ‘Brian Krebs’ string is often associated with Zeus\/Zbot. VirusTotal scan<\/a> of the sample is associating it with these two as well. Go figure \ud83d\ude42<\/p>\n

Update<\/strong><\/p>\n

After I posted this entry Twitter chat with Malware Crusaders \u200f@MalwareMustDie (Thanks!) allowed me to fill-in some blanks\u00a0 + I also did a bit more code analysis myself, so entry below is updated with more details.<\/p>\n

Old post (with updates)
\n<\/strong><\/p>\n

Looking at one of recent Zeus samples I noticed the following:<\/p>\n