{ "id": "c649ef76-ab5b-4c42-b7dd-e6a60dd8c46c", "created_at": "2026-04-06T00:16:05.809039Z", "updated_at": "2026-04-10T03:28:39.978673Z", "deleted_at": null, "sha1_hash": "0154c4ea1f245d5a5fc73be7f165c01aa6e4134a", "title": "Sphinx, a new variant of Zeus available for sale", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 9613839, "plain_text": "Sphinx, a new variant of Zeus available for sale\r\nBy Pierluigi Paganini\r\nPublished: 2015-08-26 · Archived: 2026-04-05 19:13:07 UTC\r\nSphinx, a new variant of Zeus available for sale in the underground\r\nA new variant of the popular Zeus banking trojan dubbed was Sphinx is appeared\r\nfor sale on the black market, it operates entirely through the Tor network.\r\nA few days ago a new variant of the popular Zeus banking trojan was offered for sale on the black market, its\r\nname is Sphinx.\r\nSphinx code is written in C++ and is based on the source code of the ZeuS trojan. The authors have designed it\r\nto operate through the Tor network. According to the author, Sphinx is immune to sinkholing, blacklisting, and\r\nthe ZeuS tracker.\r\nThe Sphinx kit is currently available for sale at $500 USD per binary, the seller accepts Bitcoin and DASH as a\r\nmethod of payment. Buyer need to register on a website to make the payment, once registered both BTC and\r\nDASH addresses are generated.\r\nhttps://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html\r\nPage 1 of 5\n\nWhen the seller will receive the payment, buyer account is enabled and will get the rights to edit the config and\r\nrequest a build.\r\nThe seller sustains that operators that will buy it do not need bulletproof hosting, below the list of feature\r\nimplemented in the Sphinx Features:\r\nMalware:\r\nFormgrabber and Webinjects for latest Internet Explorer, Mozilla.\r\nFirefox and Tor Browser with cookie grabber and transparent page redirect(Webfakes).\r\nBackconnect SOCKS, VNC.\r\nSocks 4/4a/5 with UDP and IPv6 support.\r\nFTP, POP3 grabber.\r\nCertificate grabber.\r\nKeylogger.\r\nCertificate grabber:\r\nSphinx is able to intercept certificates when they are in use to establish a secure connection or for signing a file. It\r\nis very common in the criminal underground to abuse digital certificates, for example to digitally sign malware\r\nhttps://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html\r\nPage 2 of 5\n\ncode with digital certificates of a trusted organization in order to to bypass antivirus solutions.\r\nBackconnect VNC:\r\nThis is the most essential feature of a banking trojan. It allows you to make money transfers from the victims\r\ncomputer. Your VNC is done on a different desktop than the victim’s desktop, so its completely hidden.\r\nYou can steal money from the bank while the victim is playing multiplayer games or watching movies. Forget\r\nabout configuring the browser, because when carding with Sphinx you don’t need to.\r\nWith Backconnect VNC you can also remove anti-virus/rapport software from the victim’s computer. Port-forwarding for the victim is not required due to the use of Reverse connection.\r\nBackconnect SOCKS:\r\nUse your victims as a SOCKS proxy. Port-forwarding is not required due to use of Reverse connection.\r\nWebinjects:\r\nUsed for speeding up report gathering. With Webinjects you can change the content of a website and ask for more\r\ninformation. You can do such things as asking for credit-card data from victims PayPal/Amazon/Ebay/Facebook \r\nfor successful login.\r\nWebinjects use ZeuS format. You have to create your own web injects or use those that are publicly available.\r\nSphinx uses ZeuS format so all released webinjects for Zeus/Spyeye/Citadel are compatible.\r\nWebfakes:\r\nUsed to do phishing attacks without having to trick the victim into going in to a fake domain. For example: When\r\nconfigured for bankofamerica, the user is transparently redirected to your phishing site without changing the url.\r\nInstallation:\r\nAt the moment, the bot is primarily designed to work under Windows Vista/Seven, with enabled UAC, and\r\nwithout the use of local exploits. Therefore, the bot is designed to work with minimal privileges (including the\r\nuser “Guest”).\r\nIn this regard the bot is always working within sessions-per-user.  The bot can be set for each user in the OS, and\r\nthe bots do not know about each other. When you run the bot as a “LocalSystem” user it will attempt to infect all\r\nusers on the system.\r\nWhen you install Sphinx, the bot creates its copy in the user’s home directory. This copy is tied to the current user\r\nand OS, and cannot be run by another user. The original copy of the same bot  that was used for installation, will\r\nbe automatically deleted, regardless of the installation success.\r\nCommunication:\r\nSession with the server through a variety of processes from an internal “white list” that allows you to bypass most\r\nfirewalls. During the session, the bot can get the configuration to send the accumulated reports, report their\r\nhttps://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html\r\nPage 3 of 5\n\ncondition to the server, and receive commands to execute on the computer.\r\nThe session takes place via HTTP-protocol, all data sent by a bot and received from the server is encrypted with\r\na unique key for each botnet.\r\nWebpanel:\r\nSphinx command and control (C\u0026C) has not changed from ZeuS. Old ZeuS fans will be pleased to use this\r\ncomfortable bot network control system again. Its coded in PHP using extensions mbstring and mysql.\r\nFeatures:\r\nXMPP notification.\r\nStatistics.\r\nBotlist.\r\nScripts\r\nXMPP notification:\r\nYou can receive notifications from the Control Panel in a Jabber-account.\r\nAt the moment there is the possibility of receiving notifications about a user entering defined HTTP/HTTPS-resources. For example: it is used to capture a user session at an online bank.\r\nScripts:\r\nYou can control the bots by creating a script for them. Currently, syntax and scripting capabilities, are very\r\nprimitive.\r\nBotlist:\r\nFiltering the list by country, botnets, IP-addresses, NAT-status, etc.\r\nDisplaying desktop screenshots in real time (only for bots outside NAT).\r\nMass inspection of the Socks-servers state.\r\nDisplays detailed information about the bots:\r\nWindows version, user language and time zone.\r\nLocation and computer IP-address (not for local).\r\nInternet connection speed (measured by calculating the load time of a predetermined HTTP-resource).\r\nThe first and last time of communication with the server.\r\nTime online.\r\nAbility to set comment for each bot.\r\nStatistics:\r\nNumber of infected computers.\r\nCurrent number of bots in the online.\r\nhttps://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html\r\nPage 4 of 5\n\nThe number of new bots.\r\nDaily activity of bots.\r\nCountry statistics.\r\nStatistics by OS.\r\nThe seller suggests “using Internet Explorer traffic for the exploit-kit in order to get maximal profit while using\r\nSphinx.”\r\nAt the time I was writing the Tor website site http://dagxkme5nbxm5nkh.onion reported in the ad appears down.\r\nStay Tuned!\r\n[adrotate banner=”9″] [adrotate banner=”12″]\r\nPierluigi Paganini\r\n(Security Affairs – Zeus banking trojan, Sphinx)\r\n[adrotate banner=”5″]\r\n[adrotate banner=”13″]\r\nSource: https://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html\r\nhttps://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html" ], "report_names": [ "sphinx-variant-zeus-trojan.html" ], "threat_actors": [ { "id": "e90ec9cb-9959-455d-b558-4bafef64d645", "created_at": "2022-10-25T16:07:24.222081Z", "updated_at": "2026-04-10T02:00:04.903184Z", "deleted_at": null, "main_name": "Sphinx", "aliases": [ "APT-C-15" ], "source_name": "ETDA:Sphinx", "tools": [ "AnubisSpy", "Backdoor.Oldrea", "Bladabindi", "Fertger", "Havex", "Havex RAT", "Jorik", "Oldrea", "PEACEPIPE", "njRAT", "yellowalbatross" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434565, "ts_updated_at": 1775791719, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/0154c4ea1f245d5a5fc73be7f165c01aa6e4134a.pdf", "text": "https://archive.orkl.eu/0154c4ea1f245d5a5fc73be7f165c01aa6e4134a.txt", "img": "https://archive.orkl.eu/0154c4ea1f245d5a5fc73be7f165c01aa6e4134a.jpg" } }