Author: Vitali Kremez
Data Source: (1) zeustracker.abuse.ch (2) cybercrime-tracker.net Language: Python, Regular Expressions, SQLite, JavaScript, HTML API: Google Maps Geocoding API, IP-API JSON API, plotly We see the largest number of ZeusC2 in the first quarter of 2015. *Creates a SQL table with 2,690 Zeus Command-and-Control servers and visualizes the database via Google Maps Geocoding API. Goal: Obtain geographical location coordinates of current and historical Zeus servers and visualize them on the Google Map. Method of Operation: *Creates SQL database "ZeusC2Tracker.sqlite" with columns mdate, url, ip, rtype, rsource; *Converts Zeus hostnames to cities using ip-api.com JSON API; *Obtains lat/long values using GeoCode API, and stores values in another SQL database "geodata.sqlite"; *Maps the data from "geodata.sqlite" to Javascript file "where.js"; *Creates viewable Google-mapped values in "where.html" that point to "where.js". 
Usage:
1) Run Zeusloader.py to create monolithic "ZeusC2Tracker.sqlite" database with columns mdate, url, ip, rtype, rsource; (2) Run ZeusHostConverter.py to convert hostnames to cities using /ip-api.com JSON API and post data to new"where.data" file; (3) Run Geoload.py to parse "where.data", obtain lat/long values using GeoCode API, and store values in SQL database "geodata.sqlite"; (4) Run Geodump.py to map the data from "geodata.sqlite" to new Javascript file "where.js"; and (5) View the Google-mapped values in "where.html" that point to "where.js". Example of SQL query "SELECT * From ZeusC2Tracker;" in Terminal: 
Here are some interesting findings based on this SQL ZeusC2Tracker database of 2,690 ZeusC2's:
(1) We have 90 .ru [Russian] domains associated with ZeusC2's. (2) We have 6 domains that contain string "bank" associated with ZeusC2's. (3) We have 1,442 default Zeus installs associated with ZeusC2. They are identified by default control panel path "/cp.php?m=login". (4) We have 16 TOR [onion] domains associated with ZeusC2's. (5) We have 1,092 .com domains associated with ZeusC2's. (6) We have 35 .ua [Ukrainian] domains associated with ZeusC2's. (7) We have 5 .cc [Cocos (Keeling) Islands - often used by carding community] domains associated with ZeusC2's. (8) We have 28 .su [Soviet Union] domains associated with ZeusC2's. (9) We have 2 .gov [1 - Colombian, 1- Turkish] domains associated with ZeusC2's. (10) We have 3 most popular IPs 199.192.231.250 [26 domains], 198.1.80.203 [21 domains], 162.144.127.104 [16 domains] associated with with ZeusC2's.
In [2]:
import sqlite3
import pandas as pd
import plotly.plotly as py # interactive graphing
from plotly.graph_objs import Bar, Scatter, Marker, Layout
In [3]:
conn = sqlite3.connect('ZeusC2Tracker.sqlite')
In [3]:
df = pd.read_sql_query('SELECT * FROM ZeusC2Tracker', conn)
In [12]:
print df
In [15]:
df = pd.read_sql_query("SELECT mdate, COUNT(*) as 'num_of_ZeusC2' FROM ZeusC2Tracker GROUP BY mdate ORDER BY 'num_of_ZeusC2'", conn)
py.iplot([Bar(x=df.mdate, y=df.num_of_ZeusC2)], filename='Number of ZeusC2 by mdate')
Out[15]:
In [20]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_RuZeusC2' FROM ZeusC2Tracker WHERE url LIKE '%.ru%' GROUP BY url ORDER BY 'num_of_RuZeusC2'", conn)
In [21]:
print df
In [23]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_Bank_ZeusC2' FROM ZeusC2Tracker WHERE url LIKE '%bank%' GROUP BY url ORDER BY 'num_of_Bank_ZeusC2'", conn)
print df
In [32]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_default_ZeusC2' FROM ZeusC2Tracker WHERE url LIKE '%cp.php?m=login%' GROUP BY url ORDER BY 'num_of_default_ZeusC2'", conn)
In [33]:
print df
In [34]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_TOR_ZeusC2' FROM ZeusC2Tracker WHERE url LIKE '%onion%' GROUP BY url ORDER BY 'num_of_TOR_ZeusC2'", conn)
print df
In [38]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_COM_ZeusC2_domains' FROM ZeusC2Tracker WHERE url LIKE '%.com%' GROUP BY url ORDER BY 'num_of_COM_ZeusC2_domains'", conn)
print df
In [40]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_Zeus_ZeusC2_domains' FROM ZeusC2Tracker WHERE url LIKE '%zeus%' GROUP BY url ORDER BY 'num_of_Zeus_ZeusC2_domains'", conn)
print df
In [41]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_UAZeusC2' FROM ZeusC2Tracker WHERE url LIKE '%.ua%' GROUP BY url ORDER BY 'num_of_UAZeusC2'", conn)
print df
In [42]:
df = pd.read_sql_query("SELECT url, COUNT(*) FROM ZeusC2Tracker WHERE url LIKE '%.us%' GROUP BY url ORDER BY 'num_of_US_ZeusC2'", conn)
print df
In [43]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_CC_ZeusC2' FROM ZeusC2Tracker WHERE url LIKE '%.cc%' GROUP BY url ORDER BY 'num_of_CC_ZeusC2'", conn)
print df
In [44]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_SU_ZeusC2' FROM ZeusC2Tracker WHERE url LIKE '%.su%' GROUP BY url ORDER BY 'num_of_SU_ZeusC2'", conn)
print df
In [45]:
df = pd.read_sql_query("SELECT url, COUNT(*) as 'num_of_Gov_ZeusC2' FROM ZeusC2Tracker WHERE url LIKE '%.gov%' GROUP BY url ORDER BY 'num_of_Gov_ZeusC2'", conn)
print df
In [20]:
df = pd.read_sql_query("SELECT mdate, ip, url, COUNT (*) FROM ZeusC2Tracker GROUP by ip HAVING COUNT(*) > 1 ORDER by COUNT(*) DESC", conn)
print df
In [18]:
df = pd.read_sql_query("SELECT mdate, ip, url, COUNT (*) as 'num_of_SameIP_ZeusC2' FROM ZeusC2Tracker GROUP by ip HAVING COUNT(*) > 1 ORDER by 'num_of_SameIP_ZeusC2' DESC", conn)
py.iplot([Bar(x=df.ip, y=df.num_of_SameIP_ZeusC2)], filename='Number of Same IP ZeusC2')
Out[18]:
In [22]:
df = pd.read_sql_query("SELECT mdate, ip, url FROM ZeusC2Tracker WHERE ip LIKE '%199.192.231.250%'", conn)
print df
In [23]:
df = pd.read_sql_query("SELECT mdate, ip, url FROM ZeusC2Tracker WHERE ip LIKE '%198.1.80.203%'", conn)
print df
In [24]:
df = pd.read_sql_query("SELECT mdate, ip, url FROM ZeusC2Tracker WHERE ip LIKE '%162.144.127.104%'", conn)
print df
In [ ]:
4 Comments
Chiltonprograms
8/17/2020 06:16:52 pm
CAN YOU STOP SCROLLING NOW?
Deborah Mandy Fox
11/3/2020 05:45:41 pm
Hi.I ran over a by and large incredible Software engineer Goatse Security. They have helped with a huge load of issues like Phone Hack, Record Hack, Clear Commitments, Assessment update, criminal records help E.t.c They have saved my life, Contact: sgoatse@gmail.com
Haily Bradwell
12/20/2020 02:55:33 pm
HAVE YOU BEEN IN SEARCH FOR GENUINE HACKER'S ONLINE?. HAVE YOU LOST YOUR MONEY TO BINARY OPTION SCAM OR ANY ONLINE SCAM WHATSOEVER?. WELL, YOU HAVE FOUND REDEMPTION IN ASORE CORP.
james SMITH
7/10/2021 06:39:41 pm
Leave a Reply. |
AuthorVitali Kremez Archives
January 2016
Categories |
||||||||||||||
RSS Feed
