@Capysec Security Research

Introduction :   If there existed an award for the cutest and most benign sounding family of malware, I am not hesitant to say that the developers of the HelloKitty ransomware would be walking home with the highest honor. That being said, the use of charming and otherwise innocuous sounding names for some of the worst and most malicious malware isn’t a new development. From the comforting-sounding ILOVEYOU worm that originated from the Philippines in 2000 and went on to infect the rest of the planet, to Nation State developed spyware like “ Babar ” (referencing the adorable Elephant from the French children’s literature classic), the utilization of harmless and defusing monikers for malware is just another way for threat actors to further explore their creativity and sense of humor. Hell, it's not even uncommon for individuals to give themselves names of  HelloKitty is not the first and will surely not be the last strain of malware to be given such a name, either afterwards b...

 Note: This is a reupload of my writeup of the history of the ZeuS malware from my original website. INTRODUCTION:  Image Source:  https://www.bankinfosecurity.com/zeus-banking-trojan-spawn-alive-kicking-a-10471 When discussing the history of malware, you are more than likely going to hear the same few names over and over again. Conficker, Welchia, ILOVEYOU, Stuxnet, Flame, CryptoLocker, Dridex, and even newer malware like WannaCrypt0r, Emotet, and Maze.  What is left behind but stands atop the lesser remembered malware of the last fifteen years in particular is the ZeuS or Zbot Trojan and its successor, the Gameover ZeuS Trojan. This will be a historical summary of the ZeuS and Gameover ZeuS Trojans, beginning from its initial discovery and ending in the current year.  I will be using a variety of sources for my analysis. This is NOT a technical analysis of the malware, simply a historical account. I plan on writing a full technical analysis of the ZeuS and Gam...