Win32/Zeus (alias Zbot)

[SecConnex]

Seems like Trj.Agent updates all the time.

Newer versions of Trj.Agent are doing more tricky rootkit techniques.

Have a look at this sample, thanks to Jaxryley:

http://www.mediafire.com/?3jmlljnmodj1zwm

[ssj100]

Password is "infected" for anyone that didn't already know. Cheers.

[SecConnex]

Ooops. Thanks, ssj.

[markusg]

Hi,
i'm searching zeus3 droppers and an zeus3 builder.
perhaps somebody can share samples?
thx for your help

[EP_X0FF]

Hello,

not sure which version is it.

http://www.virustotal.com/file-scan/rep ... 1281966574

i can look for more samples earlier.

Regards.

[markusg]

yer this what i'm searching for
when you find more it would be nice to post it. thx for your help

[Evilcry]

Hi,

I just want to put a clarification relative to naming convenction, technically ZeuS v3 does not exists,
ZeuS has always the same structure and version numeration does not presents a jump..this is one another
mystification performed by some Vendor to fire up more pain

Actual intelligence does not reveal any evidence of ZeuS 3 existence

Regards,
Evilcry

[EP_X0FF]

Thanks for clarification

Here are more samples.

http://www.virustotal.com/file-scan/rep ... 1281972266
http://www.virustotal.com/file-scan/rep ... 1281972273
http://www.virustotal.com/file-scan/rep ... 1281972284

[markusg]

i want to say thx for files and info

[markusg]

i'm searching this zbot variannt:
http://www.f-secure.com/weblog/archives/00002037.html
perhaps somebody can help.