Loading malware…
Murofet, also known as LICAT, is a ZeuS-family malware lineage associated with private builds active roughly from September 2010 to September 2011. It is notable for using a Domain Generation Algorithm to derive command-and-control domains, a design that complicated sinkholing and takedown efforts and foreshadowed later Zeus-family evolutions such as Gameover Zeus. At least three Murofet DGA variants have been documented. All use an MD5-based generation process derived from date-related values and an index, but they differ in rotation period, character generation, and keying. Variant 1 and Variant 3 rotate on a weekly basis and do not use a key, while Variant 2 rotates daily and incorporates an XOR key, enabling effectively unlimited distinct domain sets. Variant 3 is distinguished by unusually long domains that may include paired digits. Murofet is best understood as a Zeus-related command-and-control mechanism and malware branch rather than a standalone commodity family unrelated to Zeus. High-confidence reporting directly supports its Zeus-family affiliation and DGA-based command-and-control behavior; broader banking-trojan functionality is implied by that lineage but is not independently established here for this specific entry.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family mentioned only as part of the Zeus descendant lineage.
A ZeuS-family malware that uses a Domain Generation Algorithm to generate command-and-control domains. The content discusses three DGA variants with differing cadence, key usage, TLD sets, and domain-generation logic.
Mentioned only as another malware family using hashing-based DGA techniques for comparison.
A private-build Zeus-family malware variant mentioned in the historical evolution leading to Gameover Zeus.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.