UDP port / TCP port / IPv6 port / IPv4 port / Herbert Bos VU University / /
IndustryTerm
Internet access / botnet protocols / signature-based intrusion detection systems / decryption algorithm / communication protocol / working Internet access / /
NaturalFeature
DGA channel / /
OperatingSystem
Microsoft Windows / /
Organization
Zeus Peer-to-Peer Protocol Dennis Andriesse and Herbert Bos VU University Amsterdam / European Union / /
Person
Christian Rossow / Daniel Plohmann / Tillmann Werner / Christian J. Dietrich / Herbert Bos / Tomasz Bukowski / Brett Stone-Gross / /
Position
King / /
ProvinceOrState
Ontario / /
Technology
deprecated Zeus rolling XOR decryption algorithm / IPv6 / XOR algorithm / peer-to-peer / extensively investigated eration Algorithm / top-level domain / api / Peer-to-Peer Protocol / P2P botnet protocols / P2P / P2P protocol / UDP / 4.1 Algorithm Details The Zeus Domain Generation Algorithm / little-endian / pdf / 4 Domain Name Generation Algorithm / cmp / encryption / HTTP-based C2 protocol / sub-botnet Algorithm / protocol of the peer-to-peer / XOR encryption / ASCII / Zeus P2P communication protocol / communication protocol / rolling XOR algorithm / HTTP / message encryption / Zeus P2P protocol / RC4 encryption / C2 protocol / IPv4 / 3 P2P Protocol / encrypted using a rolling XOR algorithm / /
An Analysis of the Zeus Peer-to-Peer Protocol Dennis Andriesse and Herbert Bos VU University Amsterdam, The Netherlands {d.a.andriesse,h.j.bos}@vu.nl Technical Report IR-CS-74, rev. April 10, 2014 Abstract