ZLoader Malware Profile & 7d C2 Tracker

ZLoader

Family profile

ZLoader is a Windows banking trojan and loader derived from the Zeus code lineage and first publicly identified in 2016. It is also known as Terdot and has remained under active development, evolving from a credential-focused banking malware family into a broader access and payload-delivery platform used in financially motivated intrusion chains.

ZLoader is primarily associated with theft of banking credentials, cookies, passwords, and other sensitive browser data through web injection and related browser-focused collection techniques. Reported variants also support remote access through VNC-style functionality, enabling operators to interact with victim systems directly. Beyond theft, ZLoader has been used as an initial-stage malware component to deliver additional payloads, including post-exploitation frameworks and ransomware, making it relevant both as a banking trojan and as an access broker tool in multi-stage attacks.

Observed delivery methods include phishing campaigns, malicious Office macro documents, malvertising, fake software installers, and cracked-software lures. Campaigns have used deceptive software download themes, including fake remote-access software installers and malicious signed MSI packages, as well as Google advertisement redirection to attacker-controlled landing pages. ZLoader-related activity has also been associated with abuse of MSIX packaging and legitimate installer components to reduce detection.

On infected Windows hosts, documented ZLoader tradecraft includes defense evasion through disabling Microsoft Defender, privilege escalation via UAC bypass techniques, persistence through autorun mechanisms, and process injection or thread hijacking into legitimate processes. Infrastructure associated with some campaigns has used domain generation algorithms, and researchers have also documented DNS-tunneling concepts being discussed in relation to comparable command-and-control patterns across crimeware ecosystems.

ZLoader has been linked to multiple financially motivated threat actors and botnets, including campaigns attributed to TA547 and TA544, and botnet clusters such as Tim. It has frequently appeared in the broader cybercrime ecosystem alongside malware families such as TrickBot, Ursnif, Qbot, DanaBot, Buer Loader, BazaLoader, and SystemBC. It has been observed enabling follow-on deployment of ransomware including Ryuk and Egregor, underscoring its role as both a banking malware family and a first-stage intrusion enabler. Targeting has included banking customers, with specific campaigns focusing on users in Australia and Germany, while broader spam and malware-delivery operations have affected multiple regions and industries.

Capabilities

Credential Theft
Defense Evasion
Persistence
Post Exploitation
Privilege Escalation
Process Injection
Session Hijacking

Reported operators

Threat actors

5 named in public reporting

TA547

Delivered malware included ZLoader (a.k.a. Terdot), Gootkit, Ursnif, Corebot, Panda Banker, Atmos, Mazar Bot, and Red Alert Android malware.

TA544

Spain (Defunct) Castilian ZLoader Medium Volume Technology, Manufacturing & Hospitality Campaigns began experimentally in August of 2017 and ended in September of 2017.

TA571

Since the Emotet takedown, Proofpoint observed consistent, ongoing activity from The Trick, Dridex, Qbot, IcedID, ZLoader, Ursnif, and many others in our data serving as first-stage malware payloads in attempts to enable further infections, including ransomware attacks.

TA574

Since the Emotet takedown, Proofpoint observed consistent, ongoing activity from The Trick, Dridex, Qbot, IcedID, ZLoader, Ursnif, and many others in our data serving as first-stage malware payloads in attempts to enable further infections, including ransomware attacks.

FIN7

MSIX package abuse has been observed in various threat campaigns, including those from FIN7, Zloader (Storm-0569), and FakeBat (Storm-1113).

MITRE ATT&CK

ZLoader in ATT&CK

28 distinct techniques

Techniques

28 techniques

Reporting

Research mentioning ZLoader

Jul 23

Cyber Security News

TrickBot Turns Ordinary DNS Traffic Into a Hidden Channel for Malware Commands

Researchers identified a TrickBot variant for Microsoft Windows that replaces its usual HTTP command-and-control channel with a custom DNS tunneling mechanism, allowing the malware to hide outbound tasking in malformed DNS queries and reconstruct inbound data from IPv4 addresses returned in DNS responses. Fortinet said the malware sends XOR-encrypted, hex-encoded command data in chunks designed to resemble legitimate domain labels, with traffic observed via 8.8.8.8 and a command-and-control domain of westurn.in. The transport redesign preserves TrickBot’s modular architecture while making communications harder to detect and block. The malware maintains persistence through Windows Task Scheduler, with tasks configured to run every five minutes, and stores task metadata in NTFS Alternate Data Streams to reduce visibility. Fortinet reported the variant also uses encrypted strings and hash-based runtime API resolution to complicate analysis, while retaining capabilities for module download, rundll32-based execution, PowerShell execution, direct machine-code execution, process hollowing, and process doppelgänging. Researchers measured the DNS tunnel at roughly 30.7 KB/s, indicating the channel is practical for sustained covert command-and-control operations.

Jul 23

Hackread