Malware
Zeus Sphinx
This family describes the vanilla Zeus-variant that includes TOR (and Polipo proxy).
Zeus Sphinx is a Windows malware family.
Background
This family refers to the plain Zeus variant that ships with TOR (along with the Polipo proxy). It shares nearly 90% of its code with Zeus v2.0.8.9. Note that IBM X-Force chose to label win.zloader/win.zeus_openssl as "Zeus Sphinx" after referring to it as "a new version of Zeus Sphinx" in their August 2016 post. Malpedia therefore records the alias "Zeus XSphinx" for win.zeus_openssl, with the X denoting IBM X-Force.
Zeus Sphinx on the one hand has the following versioning ("slow increase")
- 2015/09 v1.0.1.0 (Zeus Sphinx size: 1.5 MB)
- 2016/02 v1.0.1.2 (Zeus Sphinx size: 1.5 MB)
- 2016/04 v1.0.2.0 (Zeus Sphinx size: 1.5 MB)
Zeus OpenSSL on the other hand has the following versioning ("fast increase")
- 2016/05 v1.5.4.0 (Zeus OpenSSL size: 1.2 MB)
- 2017/01 v1.14.8.0 (Zeus OpenSSL size: 1.8 MB)
- 2017/01 v1.15.0.0 (Zeus OpenSSL size: 2.2 MB)
Source: Malpedia (Fraunhofer FKIE).