0day - zeusovertor


Why Z0t?
------------------
EXTREME RESILIENCE
------------------
Zeus Over Tor cannot be shut down by Spamhaus or Zeus-Tracker or any methods currently employed by organizations hell bent on removing the zeus threat. It can't be shut down because you cannot find the ip address of the hosting from the hidden service address and so thus cannot report to the hosting company that you are indeed hosting malware. Furthermore Zeus Over Tor does not require you to register a domain, you have a hidden service address and as such you can easily move your botnet within one hour and your hidden service domain cannot be shut down because with hidden service there is no domain registration. The domain is generated dynamically when you create your hidden service. This feature alone makes Zeus Over Tor the most resilient and easy to maintain financial malware currently available on the market, bar none.
==========================================================
Sphinx is tested and working on WinXP, Win7, Win8, Win8.1, Windows10. Internet, Firefox And Chrome Latest versions tested -- 11.02.2016
------------------------------------------
In Depth Analasys of Zeus By British Media
------------------------------------------
[youtube]https://www.youtube.com/watch?v=DUnZMwXCkyw[/youtube]
https://www.youtube.com/watch?v=DUnZMwXCkyw
MAN IN THE BROWSER PART 1

[youtube]https://www.youtube.com/watch?v=14TZOjG97EM[/youtube]
https://www.youtube.com/watch?v=14TZOjG97EM
MAN IN THE BROWSER PART 2

-------------------------------------------------------------------
Vice Documentary On Fraud In The UK - (Zeus is inevitably the source of many of the details acquired and used to commit fraud based in this documentary)
-------------------------------------------------------------------
[youtube]https://www.youtube.com/watch?v=lA4R84xfLOQ[/youtube]
https://www.youtube.com/watch?v=lA4R84xfLOQ
Vice - How To Get Away With Stealing


================================================================
Zeus0verTor trojan is coded in C++ based on ZeuS source-code. It
operates fully through the Tor network using Tor hidden service. Zeus0verTor
is immune to sinkholing, blacklisting and ZeuS tracker.

:: Malware:
- Formgrabber and Webinjects for latest Internet Explorer, Mozilla
Firefox, Google Chrome and Tor Browser with cookie grabber fo IE and transparent page
redirect(Webfakes).
- Backconnect SOCKS, VNC.
- Socks 4/4a/5 with UDP and IPv6 support
- FTP, POP3 grabber
- Certificate grabber
- Keylogger
- Installation


Backconnect VNC - WinXp, VIsta: https://vimeo.com/147444171

It allows you to make money transfers right from your victims computer. Your VNC is
done on a different desktop than victim is using so its completely
hidden. You can steal money from bank while victim is playing
multiplayer games or watching movies. Forget about configuring browser,
because when carding with Zeus0verTor you don't need to. With Backconnect
VNC you can also remove anti-virus/rapport software from victim. Port-
forwarding for victim is not required due to use of Reverse connection.

Backconnect SOCKS:
Use your victims as a SOCKS proxy. Port-forwarding is not required due
to use of Reverse connection.

Webinjects:
Used for speeding up report gathering. With Webinjects you can change
the content of website and ask more information. You can do such things
as asking for credit-card data from victims PayPal/Amazon/Ebay/Facebook
for successful login. Webinjects use ZeuS format.

Webfakes:
Used to do phishing attacks without having to trick victim in to going
in to a fake domain. When configured for bankofamerica, user will be
transparently redirected to your phish site without changing url.

Installation:
At the moment, the bot is primarily designed to work under Vista/Seven,
with enabled UAC, and without the use of local exploits. Therefore the
bot is designed to work with minimal privileges (including the user
"Guest"), in this regard the bot is always working within sessions per
user (from under which you install the bot.). Bot can be set for each
use in the OS, while the bots will not know about eachother. When you
run the bot as "LocalSystem" user it will attempt to infect all users
in the system.

When you install, bot creates its copy in the user's home directory,
this copy is tied to the current user and OS, and cannot be run by
another user, or even more OS. The original copy of the same bot (used
for installation), will be automatically deleted, regardless of the
installation success.


:: Webpanel:
Zeus0verTor uses the same familiar Zeus command and control panel

Features:
- XMPP notification
- Statistics
- Botlist
- Scripts

XMPP notification:
You can receive notifications from the Control Panel in the Jabber-
account.

At the moment there is a possibility of receiving notifications about a
user entering a defined HTTP/HTTPS-resources. For example, it is used
to capture user session in an online bank.

Scripts:
You can control the bots by creating a script for them.

Statistics:
- Number of infected computers.
- Current number of bots that are online.
- The number of new bots.
- Daily activity of bots.
- Statistics by OS.

-------------------------
-------------------------


PRICE: $500 Per Bin --- New version pending upon which price will sharply rise - [NOTE] The builder is not for sale. [NOTE]
======================================================
If you wish to setup your server ask us for the panel files before purchase.
------------------------------------------------------------------
If you wish for us to setup your server:
PRICE: 100$ --- Fresh Servers Only. We can provide a server for you if you wish this will take 12 hours. We appreciate your kindness in not asking our sales & tech guys for free tech support and server setup. All sales are final and we do not give refunds for reasons of customers not being able to setup their servers and wanting free setup. A free tutorial will be provided to each customer for windows server setup, if setup is required we can do this for the price stated above.


We also provide traffic and exploit kit if needed.

I thank you for your patience in reading & welcome to Zeus0verTor. The future in financial malware.
Zeus0verTor Demo panel and bot
---------------------------------------------
http://6araahcqgbaebwcs.onion/cp.php?m=login
---------------------------------------------
user: alphabay
pass: alphabay
------------------------------------------------------------------------------
Here is the link for the uncrypted bot:https://www.sendspace.com/file/yyme62
------------------------------------------------------------------------------
This is a demonstration panel and uncrypted executable of Zeus0verTor for public use.
--------------------------------------------------------------------------------------

==============================
Jabber: zeusovertor@exploit.im - Sales Support & Tech
z0t_support@exploit.im - Lead Sales
z0t_support@siph0n.pw - Sales
==============================