Zeus
Aliases: Zbot
- Malware type
- botnet, credential-stealer, trojan
- Family
- Malware family
- Related IoCs
- 2098 (1908 malicious)
- Last IoC activity
- 2026-10-17 03:48:16
- Profile updated
- 2026-07-07 12:40:11
Targeted industries: financial-services
Context
According to CrowdStrike, The two primary goals of the Zeus trojan horse virus are stealing people's financial information and adding machines to a botnet. Unlike many types of malware, most Zeus variants try to avoid doing long-term damage to the devices they infect. Their aim is to avoid detection from antivirus software.
Detection coverage
- 5 YARA rules
Detection rules
- MALPEDIA_Win_Zeus_Mailsniffer_Auto (yara-rule)
- MALPEDIA_Win_Zeus_Auto (yara-rule)
- MALPEDIA_Win_Zeus_Action_Auto (yara-rule)
- MALPEDIA_Win_Zeus_Openssl_Auto (yara-rule)
- MALPEDIA_Win_Zeus_Sphinx_Auto (yara-rule)
Related threat objects
- Zeus (infrastructure)
Reports & references
- Trend Micro — Ssl Tls Technical Brief (report)
- secureworks.com — Bronze Woodland (report)
- secureworks.com — Gold Evergreen (report)
- secureworks.com — Evolution Of The Gold Evergreen Threat Group (report)
- krebsonsecurity.com — Inside Evil Corp A 100M Cybercrime Menace (report)
- CISA — Aa20 345A (report)
- cert.ssi.gouv.fr — Certfr 2020 Cti 008 (report)
- youtube.com — Watch (report)
- contagiodump.blogspot.com — Dec 2012 Linuxchapro Trojan Apache (report)
- cisecurity.org — Top 10 Malware March 2022 (report)
- secureworks.com — Gold Evergreen (report)
- Cisco Talos — Threat Roundup 0204 0211 (report)
- Palo Alto Unit 42 — Banking Trojan Techniques (report)
- justice.gov — Foreign National Pleads Guilty Role Cybercrime Schemes Involving Tens Millions Dollars (report)
- bleepingcomputer.com — Zeus Icedid Malware Gangs Leader Pleads Guilty Faces 40 Years In Prison (report)
- Trend Micro — Kivars With Venom Targeted Attacks Upgrade With 64 Bit Support (report)
- wired.com — Russian Hacker Spy Botnet (report)
- kryptoslogic.com — Trickbot And Zeus (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Zeus (report)
- Broadcom/Symantec — Spyeye S Kill Zeus Bark Worse Its Bite (report)
- eternal-todo.com — Zeus Spreading Facebook (report)
- nrc.nl — The Cesspool Of The Internet Is To Be Found In A Village In North Holland A4038369 (report)
- secureworks.com — Zeus (report)
- Broadcom/Symantec — Zeus King Of Bots (report)
- krebsonsecurity.com — Top Zeus Botnet Suspect Tank Arrested In Geneva (report)