Malware

Zusy

Zusy is a Windows malware family most commonly classified as a trojan and frequently encountered in multi-stage criminal delivery chains as a secondary payload. It has been observed being delivered to already infected systems by other malware, including Mylobot, and it has also appeared in broader malware distribution activity where samples may be inconsistently labeled across antivirus engines alongside other families. In one documented campaign exploiting interest in the Russia-Ukraine conflict, a malicious executable masquerading as a hacktivist DDoS utility was distributed via Telegram and ultimately delivered an information-stealing payload; at least one associated detection name mapped that activity to Zusy.

Operationally, Zusy is associated with Windows-based post-compromise activity and has been linked to credential and cryptocurrency-related data theft in campaign reporting where it appeared as the identified or detected payload. Delivery has relied on social-engineering lures, including fake offensive security tools and war-themed bait, as well as downstream installation by other malware acting as loaders or botnets. The family is relevant to financially motivated cybercrime operations rather than a specific state-linked intrusion set based on the available facts here. Because the name also appears as an antivirus classification in mixed-label telemetry, some reporting may conflate Zusy with adjacent trojan or infostealer activity; only the Windows trojan/stealer usage is supportable at high confidence from the available information.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.001PowerShellEvidence1

PowerShell command execution: executes PowerShell commands that reach out to two different URLs... leading to the first stager of the spreader

Privilege Escalation

1 technique

T1055Process InjectionEvidence3

When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe".

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The script is obfuscated and employs a custom string encoding routine... Heavy obfuscation: the script uses multiple layers of obfuscation to obscure its behavior.

T1036MasqueradingEvidence2

The campaign is based on a dropper disguised as the Disbalancer.exe tool.

T1055Process InjectionEvidence3

When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe".

Credential Access

4 techniques

T1056Input CaptureEvidence1

It hooks into browsers and steals login data and sniffs on network traffic.

T1056.001KeyloggingEvidence1

the protocol now includes a range of additional custom commands... COLADIFKEYBOARD to inject arbitrary text as keystrokes.

T1056.003Web Portal CaptureEvidence1

the malware contains functionality to display fake pop-ups prompting victims to enter their banking credentials. The images for these pop-ups are stored as encrypted resources.

T1555Credentials from Password StoresEvidence1

It includes SQL commands used to harvest credentials from browsers.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

Information gathering and exfiltration: collects the host IP, hostname, username, and OS version, then sends this data to a C2 server.

Collection

4 techniques

T1056Input CaptureEvidence1

It hooks into browsers and steals login data and sniffs on network traffic.

T1056.001KeyloggingEvidence1

the protocol now includes a range of additional custom commands... COLADIFKEYBOARD to inject arbitrary text as keystrokes.

T1056.003Web Portal CaptureEvidence1

the malware contains functionality to display fake pop-ups prompting victims to enter their banking credentials. The images for these pop-ups are stored as encrypted resources.

T1185Browser Session HijackingEvidence2

TinyBanker, also known as Zusy or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information.

Command and Control

4 techniques

T1001Data ObfuscationEvidence1

One thing very consistent is 13 byte initial RC4 encoded request.

T1071Application Layer ProtocolEvidence2

Tinba uses four hardcoded domains for its C&C communication.

T1095Non-Application Layer ProtocolEvidence1

the malware supports raw socket communication using a custom protocol that encapsulates commands into tags such as <|SIMPLE_TAG|> or <|TAG|>Arg1<|>Arg2<<|>

T1105Ingress Tool TransferEvidence3

Message ID (msg_id) Description ... 7 Download a binary using HTTP 8 Download multiple binaries using HTTP + delay (8 hours)

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Information gathering and exfiltration: collects the host IP, hostname, username, and OS version, then sends this data to a C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

73 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

35 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

36 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

bridewell blogNews

Jan 1, 2026

Uncovering the “Easy Stealer” Infostealer

Mentioned only as a malware label on files sharing an import hash with the analyzed sample.

bitsightNews

Feb 13, 2023

Mylobot: Investigating a proxy botnet | Bitsight

Zusy is mentioned as another malware payload reportedly delivered to infected computers via Mylobot download commands.

talosintelligence otherNews

Mar 9, 2022

Threat advisory: Cybercriminals compromise users with malware disguised as pro-Ukraine cyber tools

Mentioned only as a ClamAV detection name in coverage/IOC material, without substantive discussion in the article body.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching73

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Zusy