4

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?

Improve this question

3 Answers 3

Reset to default
8

Providing that you are looking for information already analyzed, and your question is not about the technical ways to identify a Zeus C&C Server, you can look at the following places:

Note that you can also use those places to look for many other threats / malicious activities than Zeus.

Improve this answer
5

First, you can look at the abuse.ch zeustracker list.

Second, note that the abuse.ch list is the primary source for the iblocklist.com zeus list. You may also wish to look through some of the many other malware lists on iblocklist.com to check for other malware sites.

Separately, you can check to see on what basis your security appliance is making the determination - is it using a list (perhaps one of these)? If it is using a list, which one, and how often does it update it? Is it using traffic analsis (like Snort would) instead?

Improve this answer
1

When I get alerts of possible zeus infection from the security appliances, this is what I usually do:

  1. check the URL with zeustracker
  2. if the URL is not in the zeustracker db, check on virustotal
  3. if there is detections, likely this is a malicious connection
  4. Run a tcpdump on the connection to check the packets

zeustracker has a guide showing how to identify zeus malware, go take a look

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .