Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?

share|improve this question
add comment

3 Answers

Providing that you are looking for information already analyzed, and your question is not about the technical ways to identify a Zeus C&C Server, you can look at the following places:

Note that you can also use those places to look for many other threats / malicious activities than Zeus.

share|improve this answer
add comment

First, you can look at the abuse.ch zeustracker list.

Second, note that the abuse.ch list is the primary source for the iblocklist.com zeus list. You may also wish to look through some of the many other malware lists on iblocklist.com to check for other malware sites.

Separately, you can check to see on what basis your security appliance is making the determination - is it using a list (perhaps one of these)? If it is using a list, which one, and how often does it update it? Is it using traffic analsis (like Snort would) instead?

share|improve this answer
add comment

When I get alerts of possible zeus infection from the security appliances, this is what I usually do:

  1. check the URL with zeustracker
  2. if the URL is not in the zeustracker db, check on virustotal
  3. if there is detections, likely this is a malicious connection
  4. Run a tcpdump on the connection to check the packets

zeustracker has a guide showing how to identify zeus malware, go take a look

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.