KernelMode.info

A forum for kernel-mode exploration.

Skip to content

Citadel (Zeus clone)

Forum for analysis and discussion about malware.
Post a reply

Citadel (Zeus clone)

Postby Xylitol » Tue Feb 07, 2012 1:19 pm

Citadel samples by version:
Citadel 1.3.4.0
Citadel 1.3.4.5
Citadel 1.3.5.1
Citadel 1.2.0.0
Citadel 3.1.0.0
Atmos 0.0.1.1

Related materials:
Backdoor.Citadel.BkCnct
Hacktool.Citadel.Builder
Troj.ZbotPHP-A

Microsoft lawsuit against Citadel botherders: >>146519568

For 1.2.0.0 and 3.1.0.0 those are *private* version of Citadel, if you look for ressources:
S21Sec: Citadel hasn't gone
S21sec: Citadel "involution"
S21sec: Zeus-Я-uS
S21sec: ZeuS timeline 2
Hexacorn: Zeus trivia

Atmos, version 0.0.1.0 and 0.0.1.1:
JPCERT: Banking Trojan “Citadel” Returns
User avatar
Xylitol
Global Moderator
 
Posts: 1626
Joined: Sat Apr 10, 2010 5:54 pm
Location: Seireitei, Soul Society
Reputation point: 485
Top

Citadel (Zeus clone)

Postby sleeper » Thu Feb 09, 2012 1:05 pm

New Zeus Clone.

Was featured by Brian Krebs and seems to have some interesting Features (see here).

Anybody got a sample?
sleeper
Banned
 
Posts: 2
Joined: Wed Jun 29, 2011 5:00 pm
Reputation point: 0
Top

Re: Citadel (Zeus clone)

Postby Flopik » Sat Feb 11, 2012 1:55 am

Im interested in a sample too
Flopik
 
Posts: 47
Joined: Wed Sep 08, 2010 5:39 pm
Reputation point: 5
Top

Re: Citadel (Zeus clone)

Postby Xylitol » Sun Feb 19, 2012 12:48 pm

Sample old ~15 Jan
You do not have the required permissions to view the files attached to this post.
User avatar
Xylitol
Global Moderator
 
Posts: 1626
Joined: Sat Apr 10, 2010 5:54 pm
Location: Seireitei, Soul Society
Reputation point: 485
Top

Re: Citadel (Zeus clone)

Postby Flopik » Mon Feb 20, 2012 2:41 pm

Thanks!

Xylitol wrote:Sample old ~15 Jan
Flopik
 
Posts: 47
Joined: Wed Sep 08, 2010 5:39 pm
Reputation point: 5
Top

Re: Citadel (Zeus clone)

Postby sleeper » Tue Feb 21, 2012 10:36 am

Xylitol wrote:Sample old ~15 Jan
Thank you :)
sleeper
Banned
 
Posts: 2
Joined: Wed Jun 29, 2011 5:00 pm
Reputation point: 0
Top

Re: Citadel (Zeus clone)

Postby Evilcry » Tue Mar 20, 2012 7:52 am

Citadel 1.3
http://cyb3rsleuth.blogspot.co.uk/2012/ ... el-13.html
Evilcry
 
Posts: 135
Joined: Tue Apr 20, 2010 6:10 pm
Reputation point: 90
Top

Re: Citadel (Zeus clone)

Postby erikloman » Thu Mar 29, 2012 10:56 pm

omroepzeeland.nl briefly served Citadel through its frontpage (via java exploit).
http://nos.nl/artikel/356996-site-omroep-zeeland-geblokkeerd.html

Find fresh sample attached.
https://www.virustotal.com/file/e7256e3 ... /analysis/
You do not have the required permissions to view the files attached to this post.
Erik Loman [HitmanPro]
SurfRight B.V. - www.surfright.com
erikloman
 
Posts: 70
Joined: Sun Mar 14, 2010 8:53 am
Reputation point: 36
Top

Re: Citadel (Zeus clone)

Postby EP_X0FF » Sat Apr 28, 2012 9:33 am

http://themalwarelab.blogspot.com.es/20 ... v1340.html

Image

:D
Ring0 - the source of inspiration
User avatar
EP_X0FF
Global Moderator
 
Posts: 4749
Joined: Sun Mar 07, 2010 5:35 am
Location: Russian Federation
Reputation point: 560
Top

Re: Citadel (Zeus clone)

Postby Xylitol » Thu May 17, 2012 3:13 pm

Image Citadel C&C appeared today on ZeuS tracker, so far no sample.
Image Image Image Image Image
Image
Code: Select all
http://188.162.10.19/cp.php?m=login
http://188.162.10.19/file.php
http://188.162.10.19/api.php
http://188.162.10.19/gate.php
http://188.162.10.19/theme/style.css
http://188.162.10.19/theme/images/citadel.jpg
http://188.162.10.19/images/
http://188.162.10.19/files/
http://188.162.10.19/public/
http://188.162.10.19/system/
User avatar
Xylitol
Global Moderator
 
Posts: 1626
Joined: Sat Apr 10, 2010 5:54 pm
Location: Seireitei, Soul Society
Reputation point: 485
Top
Next
Post a reply

Return to Malware

Who is online

Users browsing this forum: No registered users and 5 guests

Powered by phpBB® Forum Software © phpBB Group