Malware
Zeus OpenSSL
aka XSphinx
This family describes the Zeus-variant that includes a version of OpenSSL and usually is downloaded by Zloader.
Zeus OpenSSL, also known as XSphinx, is a Windows malware family.
Background
This family covers the Zeus variant that bundles a build of OpenSSL and is typically pulled down by Zloader.
Version 1.5.4.0 (PE timestamp: 2016.05.11) surfaced in June 2016, delivered by Zloader (then called DEloader). Because OpenSSL 1.0.1p is statically linked into it, the binary weighs in around 1.2 MB, growing to as much as 1.6 MB over the following months. By January 2017, version 1.14.8.0 linked in OpenSSL 1.0.2j and pushed the size to 1.8 MB; shortly afterward, also in January 2017, version v1.15.0.0 obfuscated the code and ballooned the binary to 2.2 MB.
Note that IBM X-Force chose to label win.zloader/win.zeus_openssl as "Zeus Sphinx" after referring to it as "a new version of Zeus Sphinx" in their August 2016 post. Malpedia therefore records the alias "Zeus XSphinx" for win.zeus_openssl, with the X denoting IBM X-Force.
Zeus Sphinx on the one hand has the following versioning ("slow increase")
- 2015/09 v1.0.1.0 (Zeus Sphinx size: 1.5 MB)
- 2016/02 v1.0.1.2 (Zeus Sphinx size: 1.5 MB)
- 2016/04 v1.0.2.0 (Zeus Sphinx size: 1.5 MB)
Zeus OpenSSL on the other hand has the following versioning ("fast increase")
- 2016/05 v1.5.4.0 (Zeus OpenSSL size: 1.2 MB)
- 2017/01 v1.14.8.0 (Zeus OpenSSL size: 1.8 MB)
- 2017/01 v1.15.0.0 (Zeus OpenSSL size: 2.2 MB)
Source: Malpedia (Fraunhofer FKIE).