인터넷뱅킹 비상...'제우스(Zeus)' 소스 유출 - 2011.05.11 - zdnet.co.kr

Language and IDE programming:

Visual C + + (current version 9.0). No additional libraries are used
(crtl, mfc, etc.).

Supported OS:

XP / Vista / Seven, as well as 2003/2003R2/2008/2008R2. Including work
under Windows x64, but only for 32-x-bit processes. Also retained full work
boat under active sessions "Terminal Servers".

Principle:

Boat is based on intercepting WinAPI, by splicing in ring3 (user mode)
by running a copy of its code in each process the user (without using the
DLL).

Installation process:

At the moment, primarily a bot designed to work under Vista / Seven,
enabled UAC, and without the use of local sploytov. Therefore, the bot is
designed to work with minimal privileges (including the user "Guest"), with
regard to this boat is always working within sessions per user (from under
which you install the bot.). Bot can be set for each user in the OS, while
the bots will not know about each other. When you run the bot as the user
"LocalSystem" will attempt to infect all users in the system.

When you install, the bot creates a copy of a user's home directory,
this copy is tied to the current user and the operating system and can not
be run by another user, or even more operating systems. The original copy of
the same boat (used for installation) will be automatically deleted,
regardless of the success of the installation.

Session with the server (control panel):

Session with the server through a variety of processes from an internal
"white list" that allows you to bypass most firewalls. During the session,
the bot can get the configuration to send the accumulated reports, report
their condition to the server and receive commands to execute on the
computer. The session takes place via HTTP-protocol, all data sent by a bot
and received from the server is encrypted with a unique key for each botnet.

Defense:
Unique names of all objects (files, myuteksov, registry keys) to
create a bot for every user and a botnet.
Fixed bot can not be run with a different operating system or
user. Destroyed
by the code that is used to install the bot.
At the moment, not done to hide files, bot through WinAPI,
because anti-virus
tools are very easy to find such a file, and allow to pinpoint the location
of the bot.
AutoUpdate bot, do not require a reboot.
Monitoring the integrity of files the bot.

Functions of the server-side bot:
Socks 4/4a/5 server with support for UDP and IPv6.
Bekkonekt for any service (RDP, Socks, FTP, etc.) on the infected
machine. Ie may gain access to a computer that is behind a NAT, or, for
example, which prohibited the connection firewall. For this feature to work
using additional applications that run on any Windows-server on the
Internet, which has a dedicated IP.
Getting a screenshot of your desktop in real time.

Intercepting HTTP / HTTPS-requests Libraries wininet.dll (Internet
Explorer, Maxton, etc.), nspr4.dll (Mozilla Firefox):
Modification of the content loaded pages (HTTP-inject).
Transparent redirect pages (HTTP-fake).
Getting out of the page content right pieces of data (eg bank
account balance).
Temporary blocking of HTTP-injected and HTTP-fakie.
Temporary blocking of access to determine a URL.
Blocking logging requests for certain URL.
Forcing logging of all GET requests for specific URL.
A snapshot of the screen around the mouse cursor during the click of
buttons.
Getting session cookies and blocking user access to certain URL.

Get important information from the user programs:
Logins from the FTP-Client: FlashFXP, CuteFtp, Total Commander,
WsFTP, FileZilla, FAR Manager, WinSCP, FTP Commander, CoreFTP, SmartFTP.
"Cookies" Adobe (Macromedia) Flash Player.
"Cookies" wininet.dll, Mozilla Firefox.
Import certificates from the certificate store Windows. And tracking
their subsequent addition.
Tracking keystrokes.

Sniffer traffic for TCP in Windows Socket.
Intercept FTP-login on any port.
Intercept POP3-login on any port.

Others:
Execution of scripts (commands) created in the Control Panel.
Separation of the botnet to sabbotnety (by name).

Description: Control Panel

Programming Language:

PHP, using the extension mbstring, mysql.

Statistics are displayed:
The number of infected computers.
The current number of boats online.
The number of new bots.
Daily activity bots.
Country statistics.
Statistics on the OS.

Working with the list of bots:
Filtering the list by country, botnets, IP-addresses, NAT-status,
etc.
Displaying desktop screenshots in real time (only for bots is NAT).
Mass inspection of the Socks-servers.
Displays detailed information about the papers. Of the most
important here are:
Version of Windows, the user language and time zone.
Country and IP-address of the computer (non local).
Internet connection speed (measured by calculating the load time
a predefined HTTP-resource).
The first and last communication with the server.
Time online.
Ability to set comment for each bot.

Scripts (commands):

You can control the bots by creating a script for them. Currently,
syntax, and scripting capabilities are very primitive.

Working with reports (logs) and files of bots:

Files (such as screenshots, cookies Flash Player) received from the bots
are always written to the files on your server, you get the opportunity to
search for files with a filter: by name of bots, botnets, content and file
name.

Reports can be written in both files (% botnet% /% bot_id% /
reports.txt), and in the database. In the first case, the search for records
in exactly the same way as for files. In the second case, you get more
flexible filtering, and viewing reports from the Control Panel.

Receive notifications in the IM (Jabber):

You can receive notifications from the Control Panel in the
Jabber-account.

At the moment there is a possibility of receiving notifications about
entering user defined HTTP / HTTPS-resources. For example, it is used to
capture user session in an online bank.

Others:
Creating a control panel users with certain privileges.
Displays information about the server software.
Automatic recovery of corrupted tables MyISAM.

Configuration file: HTTP-inzhekty/HTTP-grabbery.

For the convenience of writing, HTTP-inzhekty/HTTP-grabbery recorded in a
separate file specified in the configuration file as
"DynamicConfig.file_webinjects". Naturally, after creating the
end-configuration file, or any additional files are generated.

The file consists of a list of URLs for which you can specify an unlimited
number of any modification thereto or derived from their data. The current
URL is the following line:

set_url [url] [options] [postdata_blacklist] [postdata_whitelist]
[url_block] [matched_context]

Parameters:
url URL, which should run HTTP-inzhekt/HTTP-grabber. Allowed the use of
masks (* and #).
options determine the basic rights and conditions for zapsuka consists of a
combination of the following characters:

P - run at POST-request.
G - run by GET-request.
L - if it is of characters is specified, the launch takes place as the
HTTP-grabber, if not specified, as the HTTP-injection produce.
D - starting blocks more than once in 24 hours. This symbol requires a
mandatory presence of the parameter url_block.
F - complements the symbol "L", allows you to record the result is not
in plain report, and as a separate file "grabbed \% host% _% year% _% month%
_% day%. Txt".
H - complements the symbol "L", saves the contents without excision of
HTML-tags. In normal mode the same, all HTML-tags are removed, and some are
transformed into a symbol of "new line" or "gap".
I - to compare the url parameter insensitive (only for English.
Alphabet).
C - compare konekst insensitive (only for English. Alphabet).

postdata_blacklist complete (from start to finish) the contents of
POST-data, which should not be run. Allowed the use of masks (wildcards *
and?).

Parameter is optional.
postdata_whitelist complete (from start to finish) the contents of
POST-data, which should be run. Allowed the use of masks (wildcards * and?).

Parameter is optional.
url_block In the absence of a character "D" in the parameter options:

If the launch must occur only once, it should specify a URL, in the case of
an appeal which, dalneshy run will be blocked. Expectation that the URL
begins immediately after application HTTP-inzhekta/HTTP-grabbera. If, after
blocking, you will need to restart, then the lock can be removed via the
command "bot_httpinject_enable" with a parameter, for example, equal to the
parameter url.
In the presence of the symbol "D" in the parameter options:

You must specify a URL, when accessed, the launch will be blocked at the 24
th hour. Expectation that the URL begins immediately after application
HTTP-inzhekta/HTTP-grabbera. This lock can not be removed by a team of
"bot_httpinject_enable".
Parameter is optional in the absence of a character "D" in the parameter
options.
matched_context Podsoderzhimoe (substring) soderimogo URL, which should be
run. Allowed the use of masks (wildcards * and?).

Parameter is optional.

With the next line begins a list of changes introduced in the contents of
the URL, and if the symbol "L" in the parameter options - a list of data
retrieved from the content URL. This is a list lasts until they reach the
end of the file, or do not specify a new URL.

Unit list consists of three elements in random order:
data_before When ..

좀 서로에게 차분하게 대응했으면 합니다.

아...또 반복하게 만드는구요...
go.kr 자료에도 언급이 되어 있거든요. 읽어보기는 하신건가요?
업계 관계자들의 이야기.. 아... 피곤해..

그 얘기, 국가기관에 얘기해 주세요.