View source for On the analysis of the ZeuS botnet crimeware toolkit

{{Publication
|Link=http://www.ncfta.ca/papers/On_the_Analysis_of_the_ZeuS_Botnet_Crimeware.pdf www.ncfta.ca
|Author=Hamad Binsalleeh, Thomas Ormerod, Amine Boukhtouta, Prosenjit Sinha, Amr M. Youssef, Mourad Debbabi, Lingyu Wang
|NomRevue=Privacy Security and Trust proceedings
|Date=2010
|Year=2010
|ISBN=978-1-4244-7551-3
|Page=31
|Botnet=ZeuS
|Abstract=In this paper, we present our reverse engineering
results for the ZeuS crimeware toolkit which is one of the recent
and powerful crimeware tools that emerged in the Internet
underground community to control botnets. ZeuS has reportedly infected over 3.6 million computers in the United States. Our
analysis aims at uncovering the various obfuscation levels and shedding the light on the resulting code. Accordingly, we explain
the bot building and installation/infection processes. In addition, we detail a method to extract the encryption key from the
malware binary and use that to decrypt the network communications and the botnet conﬁguration information. The reverse
engineering insights, together with network trafﬁc analysis, allow for a better understanding of the technologies and behaviors
of such modern HTTP botnet crimeware toolkits and opens an opportunity to inject falsiﬁed information into the botnet
communications which can be used to defame this crimeware toolkit.
}}