Zeus Botnet: An In-Depth Look at History, Impact, and Evolution

This report provides a comprehensive analysis of the Zeus botnet, a notorious malware toolkit used to create botnets for stealing banking information. It covers the history of Zeus, starting from its discovery in 2007 and its impact on various companies, including financial losses and data breaches. The report also details the different versions of Zeus, highlighting their specific functionalities and the tools used in conjunction with the botnet. It emphasizes the importance of understanding and mitigating such threats to protect sensitive data and maintain network security. The document also includes a list of references used for the analysis.

Running head: ZEUS THE KING OF BOTNET
Networking Project: Zeus the King of Botnet
Name of the student:
Name of the university:

1ZEUS THE KING OF BOTNET
Overview
Zeus is referred to as an affected network system that has become a nightmare to the
baking industries. In order to manage and build a botnet Zeus is used as a toolkit which is helpful
to provide malware creator for the required tools. Due to this malware attack most of the banking
companies are getting badly affected and the revenue structures of the banking sector are also
effecting negatively [3]. For updating and controlling the botnet and for retrieving and
organizing the information set that have been retrieved by the management must be used by the
control panel.
In order to keep the data set secured from different external attackers it is necessary for
the banking industrial head to analyze the issues properly. Many companies are there who are
facing continuous destruction from these attacks. From the history of Zeus, the details of
different versions of Zeus are also elaborated in this literature review. In addition to this the
application details in the industrial domain is also illustrated in this literature review [5]. With
the help of this technology the attackers would be able to hijack information from the server.
Different functionalities of Zeus are also elaborated in this literature review.
1.1 History of Zeus
Zeus is a kind of Trojan horse that is generally used by the attackers to steal banking
level information with the help of different form grabber and key loggers. The keys those are
stuck on to the key board of the users could be tracked with the help of the key logger software.
It means that, after this specified Trojan attack whatever the user will type on their computer will
be recorded. For retrieving the details of bank login, financial details, passwords, user identities
the attackers use this with malicious intent [1]. Even, for website injection also this Trojan horse

2ZEUS THE KING OF BOTNET
is used by the cyber criminal. It is again able to provide extra sensitive data to these lawful web
pages. In the year of 2007, this Trojan was discovered, during the stealing of data from the
United State’s transportation department. Many companies were both directly and indirectly
infected with the Zeus virus such as Bank of America, NASA, ABC, Oracle etc. Survey report
says that more than 20,000 companies were infected with the Zeus Trojan horse [8]. However,
the origin of Zeus is contradicted due to the source code selling.
In different cases it has been defined that, mostly the hackers use this kind of Trojan
horse for stealing confidential information from data server. From the business perspective this
particular approach is not at all helpful as it breaks the industrial confidentiality. In some cases
the already affected users are also warned by the message body. Mostly for maintaining the
financial details, the message bodies inform the affected users [2]. This sort if malware are used
to send different spam messages as soon as the attackers click on the link, the computer is
compromised.
From past decades the spontaneous the rate of cyber attacks is increasing rapidly and
reduction of those attacks rates are needed. From the very initial days further functionalities
those have been served by the Zeus botnet are as follows:
 It is used to gather information from different domain
 It hijacks protected information those have been stored in the data server, File Transfer
Protocol (FTP) and POP3 password as well
 Hijacks online confidential data those have been specified in the configuration file
 In order to perform the additional tasks the command and control server are contacted

3ZEUS THE KING OF BOTNET
1.2 Loss faced by companies due to Zeus
There are different companies that faced major losses after the first discovery of the Zeus
Trojan virus in the year of 2007. Many large and well known companies were affected due to
this attack such as Amazon, NASA, Oracle, Bank of America and Business weeks and many
others [1]. After the discovery of Trojan horse over 20,000 companies were infected and even
blackberry and android were also infected with this. Many other companies are also there which
have shown the Zeus botnet activity. More than 20 companies those have significantly consumer
focused brands like Google, were completely excluded from the study area [6].
1.3 Different versions of Zeus
Different tools are there that helps to accomplish the working principle of Zeus botnet
and the necessary tools are as follows: Zeus Toolkit, test bed, XAMPP, attackers and victim
machines, aegis crypter, WIN7 and WINXP virtual box etc [3].
Zeus or the Neptune serer is referred to as one of the best servers which are dependent
upon the number of factors. For selecting specified server proper process is needed to be
selected. For sorting accurate process version must be elected by the managerial heads. Based
upon the needs in the industrial sectors different Zeus versions are available in the market [7].
The users are allowed to download their desired versions. From 2007 to 2015 even no such
complimentary Trojan is discovered thus, Zeus itself was highlighted as a notorious one.
Zeus Botnet version 1.2.4.2: This version of Zeus requires certain guidelines like 2 GB
RAM, 2 CPU at 2 GHz, infrastructures like MySQL, PHP 5.2.6 Send Optimizer etc [2].
Backconnect functionality is another feature served by this particular Version.
Zeus Botnet version 2.0.8.9: This Botnet version was released in the year of 2010.

4ZEUS THE KING OF BOTNET
Zeus Botnet version 2.1.0.1: It could capture credentials over HTTP, POP3 and FTP and
as the associate configuration file is encrypted thus it could kill an entire operating system.

5ZEUS THE KING OF BOTNET
References
[1] Soltani, S., Seno, S.A.H., Nezhadkamali, M. and Budiarto, R. A survey on real world botnets
and detection mechanisms. International Journal of Information and Network Security, 3(2),
p.116. , 2014.
[2] Andriesse, D., Rossow, C., Stone-Gross, B., Plohmann, D. and Bos, H., October. Highly
resilient peer-to-peer botnets are here: An analysis of gameover zeus. In Malicious and
Unwanted Software:" The Americas"(MALWARE), 2013 8th International Conference on (pp.
116-123). IEEE. 2013.
[3] Chang, W., Mohaisen, A., Wang, A. and Chen, S, April. Measuring botnets in the wild: Some
new trends. In Proceedings of the 10th ACM Symposium on Information, Computer and
Communications Security (pp. 645-650). ACM.., 2015.
[4] Hutchings, A. and Clayton, R. Configuring Zeus: A case study of online crime target
selection and knowledge transmission., 2017.
[5] Haddadi, F. and Zincir-Heywood, A.N. Benchmarking the effect of flow exporters and
protocol filters on botnet traffic classification. IEEE Systems journal, 10(4), pp.1390-1401. 2016.
[6] Graham, M., Winckles, A. and Sanchez-Velazquez, E, July. Botnet detection within cloud
service provider networks using flow protocols. In Industrial Informatics (INDIN), 2015 IEEE
13th International Conference on (pp. 1614-1619). IEEE., 2015.
[7] Tajalizadehkhoob, S.T., Asghari, H., Gañán, C. and Van Eeten, M.J.G. Why them?
Extracting intelligence about target selection from Zeus financial malware. In Proceedings of the

6ZEUS THE KING OF BOTNET
13th Annual Workshop on the Economics of Information Security, WEIS 2014, State College
(USA), June 23-24, 2014. WEIS. , 2014.
[8] Ibrahim, L.M. and Thanon, K.H. Analysis and detection of the zeus botnet
crimeware. International Journal of Computer Science and Information Security, 13(9), p.121.,
2015.