Zeus sources sold for $ 100,000?

At the end of last year, it was rumored at hacker forums that the development of one of the most famous Zeus (or ZBot) Trojans was discontinued, and the developer transferred the program sources to another virus writer. It was said that the lucky newcomer - the author of another SpyEye Trojan - is trying hard to combine these two families into a new, more powerful product.

However, new evidence claims that the source code of Zeus was sold or transferred to a third party who is now actively looking for new buyers among cybercrime. This could lead to the development of completely new versions of Zeus / ZBot.

Specialists from various companies have already pointed out the discovery of new modifications that clearly indicate the combination of the functionality of the two Trojans.





Sources say that the author of Zeus - known as “Slavik” or “Monstr” on hacker forums - passed the Trojan code to the author of SpyEye (“Gribodemon” or “Harderman”), provided that existing users / buyers of the program and the existing botnet were supported. However, there is evidence that Slavik also sold the code to the side, as evidenced by the following screenshots from one of the forums: The



existing sales system on cybercrime forums is based on a reputation based on the number of positive and negative feedback from forum members during transactions (hi eBay! hi Habr!). The screenshots above indicate that the nem seller can hardly be a liar - he has been a member of the forum since June 13, 2009 and has 18 positive reviews.

nem offers the full Zeus code for the latest version 2.0.8.9 and warns that it is quite expensive. However, how expensive? At the end of last year, the author of Zeus sold his Trojan with full support for $ 10,000 / for one “license”. Aviv Ruff, head of technology and co-founder of Seculert, believes that the cost of the source should be approximately ten times more than the market value of such “licenses”, since the actual owner can continue to improve the code, sell new versions of the trojan and implement its support. In this regard, the amount of $ 100,000 should pay off pretty quickly.

Those interested should not run to save gold bars, cash or watch the balance on credit cards - the seller of the code agrees to transactions only using the Liberty Reserve non-trackable virtual payment system. In addition, the purchase must be made using the forum escrow system, on which the offer is posted - a system that allows the forum administrator to stop possible fraud attempts during the purchase-sale process (and again, Hi PayPal!). However, it is obvious that such a system will add to the cost - namely 6%.

A source